Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles

Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles

Ivanti confirmed on October 13, 2026 that a high-severity authentication-bypass vulnerability in Connect Secure (ICS), its flagship VPN appliance, had been under active exploitation since at least October 3, 2026 — ten days before a patch existed. The flaw, tracked as CVE-2026-104935, carries a CVSS score of 8.6 and lets an unauthenticated remote attacker forge the signals Connect Secure uses to confirm a logged-in session, allowing arbitrary command execution with no credentials at all. Security firm Volexity discovered the attacks while investigating a compromised ICS appliance that was, at the time, fully patched — and traced the intrusion to a previously unknown threat actor it now tracks as UTA0576, which chained the bug with two additional flaws to reach unauthenticated root-level code execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities (KEV) catalog the same day, ordering federal civilian agencies to complete remediation and forensic triage by October 16, 2026.

Incident Details

How the Attack Worked

A July Patch That Missed Half the Problem

Ivanti says its own internal product security program had already found part of this vulnerability and shipped a partial fix in the July 2026 release, version 25.1.3.0. That fix addressed one component of the issue but left the authentication-bypass-by-spoofing path intact — the exact gap UTA0576 later weaponized. Because the bypass rides a code path separate from normal login handling, Connect Secure's existing authentication protections never saw the forged requests at all, so even organizations that applied every prior patch remained exposed for months.

A Three-Stage Exploit Chain to Root

Volexity's analysis describes a chained attack rather than a single-flaw exploit:

1. Authentication bypass (CVE-2026-104935) — a crafted HTTP request to a Connect Secure authentication endpoint tricks the appliance into treating the request as an already-authenticated session, skipping the login requirement entirely.
2. Arbitrary file write — a second vulnerability lets the attacker write files to the appliance's filesystem once inside.
3. Privilege escalation to root — a third, still-unpatched flaw escalates that file-write access to full root-level code execution.

Ivanti has shipped fixes for the first two stages but, as of publication, is still working on a fix for the privilege-escalation flaw that completes the chain — meaning fully updated appliances can still be walked to root by an attacker who already has the first two pieces.

Stealthy Post-Exploitation

Once inside, UTA0576 moved quietly rather than dropping a persistent web shell. Volexity observed the actor stealing Active Directory credentials and actively searching for LDAP passwords, local administrator passwords managed by LAPS, and BitLocker recovery keys — classic groundwork for lateral movement and domain compromise. The actor also tampered with Ivanti's own appliance log files, specifically the access logs that Ivanti's Integrity Checker Tool (ICT) relies on for forensic validation, an apparent attempt to blind the vendor's own detection tooling. Separate telemetry from threat-intel firm Defused corroborated Volexity's findings, placing the first signs of exploitation as early as October 1, 2026. Honeypot monitoring logged roughly 105 exploit attempts against exposed appliances following public disclosure.

Impact Assessment

Recommendations

For Network and System Administrators

• Patch immediately to 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1 depending on your branch — do not wait for a bundled maintenance window given confirmed in-the-wild exploitation.
• Run Ivanti's Integrity Checker Tool (ICT), but treat a clean result with caution: UTA0576 specifically targeted the access logs ICT depends on for validation.
• Inventory every internet-facing ICS appliance in your environment; confirm none are sitting on an affected build before assuming you are unaffected.
• Because the privilege-escalation component of the chain is still unpatched, consider restricting management-plane and administrative access to trusted networks only until Ivanti ships a complete fix.

For Security Operations Teams

• Hunt for indicators of AD credential theft, anomalous LDAP queries, LAPS password retrieval attempts, and BitLocker recovery-key access originating from or near VPN appliance subnets.
• Review appliance access logs for gaps or signs of tampering rather than assuming intact logs equal no compromise.
• Treat any ICS appliance that was internet-facing between October 1 and October 13, 2026 as a priority for forensic triage, regardless of current patch level.
• Rotate credentials for any accounts with sessions or administrative access through affected appliances during the exposure window.

For IT Leadership and Risk Owners

• Track Ivanti's advisory for the still-pending fix to the privilege-escalation flaw in the chain and plan for a follow-up patch cycle.
• Factor repeated Ivanti edge-appliance zero-days (the third in about two years) into vendor risk reviews and architecture decisions around perimeter VPN infrastructure.
• Report confirmed compromises consistent with CISA's KEV guidance, even outside the federal mandate, to support broader threat-intel sharing.

Key Takeaways

1. CVE-2026-104935 is an authentication-bypass-by-spoofing flaw (CVSS 8.6) in Ivanti Connect Secure that requires no credentials and no user interaction to exploit.
2. Ivanti's July 2026 patch (25.1.3.0) fixed only part of the underlying issue, leaving the exact bypass path that UTA0576 later exploited.
3. Attackers chained the bypass with an arbitrary file-write bug and a still-unpatched privilege-escalation flaw to reach root on fully patched appliances.
4. Exploitation began around October 1–3, 2026, roughly ten days before a patch was available, and was discovered only after Volexity investigated a compromised, "fully patched" appliance.
5. CISA added the CVE to its KEV catalog on disclosure day, with a federal remediation deadline of October 16, 2026; over 5,500 ICS instances remain exposed to the internet.
6. This marks Ivanti's third actively exploited Connect Secure zero-day in roughly two years, reinforcing scrutiny of edge VPN appliances as a recurring high-value target.

Sources

• Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles — DarkReading
• CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing — watchTowr
• Attackers Chained Three Ivanti Zero-Days to Gain Root on Fully Patched VPN Appliances — Help Net Security
• Ivanti Connect Secure Zero-Day Exploited in the Wild (CVE-2026-104935) — Rapid7