Ivanti has told customers to act immediately on CVE-2026-104935, an authentication bypass and remote code execution flaw in Ivanti Connect Secure (ICS), its SSL VPN gateway. Security firm Volexity found a previously unknown actor it tracks as UTA0576 chaining that bug with a third flaw, a privilege escalation, to run commands as root on a fully patched appliance without logging in. Volexity says exploitation began on October 3; Ivanti says it is aware of “limited exploitation in the wild.” Ivanti rates CVE-2026-104935 at 8.6 out of 10.
The attacker never dropped a web shell or malware. Instead it re-ran the whole exploit chain for every command, and it deleted evidence from Ivanti debug logs and Linux audit logs, which also lets it slip past Ivanti’s Integrity Checker Tool. After getting in, it pulled stored LDAP domain credentials off the appliance, searched Active Directory for LAPS local-admin passwords and BitLocker recovery keys, and tried password spraying, which Volexity read as preparation for moving through the victim network. Ivanti has fixed the first two flaws but is still working on a patch for the privilege escalation, which Volexity says will land “in a future release in the coming weeks.” Shadowserver tracks more than 5,500 exposed ICS instances, though it is unclear how many are honeypots or already updated.
How to check if you’re affected
Affected products are Ivanti Connect Secure appliances. Volexity saw the attack on version 22.8R2.4 (the latest build when it happened), and BleepingComputer lists 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier as affected. THN reports that Ivanti’s CVE record lists versions before 25.1.3.0 as affected and 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected. Check Ivanti’s advisory for the exact version-to-fix mapping for your release train and upgrade as soon as possible.
Because the Integrity Checker Tool misses this chain, a clean scan is not proof of safety. Volexity says confirming a compromise takes forensic work (memory and network forensics). Indicators from its one investigation:
- Large numbers of requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader whose value does not match the URL path - A directory at
/data/.icscap/ - Traffic from
108.165.147[.]64 - Lateral-movement or LDAP/Kerberos activity originating from the VPN appliance itself
Neither Ivanti nor Volexity has named a workaround for customers who cannot upgrade. If the appliance was exposed on or after October 3, treat domain credentials stored on it, plus LAPS and BitLocker secrets reachable by its service account, as potentially exposed.
Sources
- Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
- Ivanti Security Advisory: Connect Secure CVE-2026-104935
- Ivanti: October 2026 Security Update
- CVE record: CVE-2026-104935
- BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks
- The Hacker News: Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far