Ivanti Rushes Patch for Actively Exploited Connect Secure Zero-Day, Third Flaw Still Unfixed

Ivanti has shipped emergency fixes for a pair of zero-day vulnerabilities in its Connect Secure VPN appliance after security researchers confirmed attackers are actively chaining them to seize control of corporate networks. The exploitation, uncovered by Volexity, marks the third consecutive year the vendor has grappled with undisclosed flaws in the product being weaponized in the wild.

The two patched issues, tracked together as CVE-2026-104935, comprise an authentication bypass and a remote code execution flaw. Together they allow an unauthenticated attacker to run arbitrary commands as the appliance's cgi-server user. A third vulnerability in the chain, a privilege escalation that elevates that access to root, remains unpatched, with Ivanti promising a fix in the coming weeks.

Ivanti rated CVE-2026-104935 at 8.6 on the CVSS severity scale. The vendor said it is aware of exploitation "affecting a limited number of customers at the time of disclosure." The U.S. Cybersecurity and Infrastructure Security Agency has marked the flaw's exploitation status as "active" and its technical impact as "total" in its own entry in the CVE record.

Volexity first detected the intrusion on October 3 on a customer's appliance that was fully patched and running version 22.8R2.4. The threat actor, previously unknown to the security firm's researchers, is now tracked as UTA0576. Ivanti disclosed the vulnerability publicly on October 13.

The vendor's advisory lists affected releases across multiple branches. According to the CVE record, Connect Secure versions before 25.1.3.0 are vulnerable, while versions 22.7R2.14 or prior, 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as not affected. Ivanti noted that it had previously identified "a portion of this vulnerability" and patched it in the July 25.1.3.0 release, but attackers began exploiting the flaw before backporting work to older branches was complete.

Unusual Attack Pattern

What sets this campaign apart is the attacker's operational approach. Rather than deploying web shells or malware, UTA0576 repeatedly re-ran the entire exploit chain to execute individual commands directly on the ICS appliance. Volexity's analysis suggests the group was focused on credential theft, data exfiltration, log tampering, and network reconnaissance, pointing to criminal motives rather than state- espionage, albeit with low confidence.

The researchers also flagged the attacker's use of "highly specific scripts using hardcoded credentials" and suggested the group may have leveraged large language models to support its operations. Because the intrusion was detected and disrupted, the ultimate objective could not be determined. Still, Volexity assessed with high confidence that the activity signaled preparation for lateral movement and broader network compromise.

The attacker took deliberate steps to evade detection. The exploit modified library code only in memory and restored altered configuration data, meaning Ivanti's Integrity Checker Tool, which the vendor recommends running regularly, would not flag the compromise. Volexity said confirming an intrusion requires forensic investigation, including network and memory forensics.

Indicators from the single incident Volexity investigated include a high volume of requests to the URL path /dana-na/auth/url_default/welcome.cgi, an HTTP header X-DSCGI-PATH with a value mismatched to the URL path, activity in the /data/.icscap/ directory, and connections from the IP address 108.165.147[.]64.

Separate Critical Flaws

The same Ivanti advisory also addressed two unrelated vulnerabilities in other products. CVE-2026-106042 affects Xtraction before version 2026.4, and CVE-2026-109412 impacts Neurons Patch for Intune. Both carry a CVSS score of 9.9, and Ivanti said it is not aware of either being exploited.

For Connect Secure customers, neither Ivanti nor Volexity has named a temporary workaround for those unable to upgrade immediately. The companies also have not clarified whether patching removes access an attacker has already established on a compromised appliance.

The disclosure extends a troubling pattern for Ivanti. January 2024 saw zero-days in Connect Secure exploited against thousands of appliances, followed by another round in January 2025. Earlier this year, suspected Chinese espionage groups were linked to exploits targeting Endpoint Manager Mobile and critical flaws in Sentry. The latest incident, arriving in October rather than the vendor's customary January window, underscores the sustained interest attackers have in perimeter security appliances.

Ivanti is urging customers to update immediately and to review Volexity's report for additional indicators of compromise. The privilege escalation fix, when it arrives, will close the final link in an attack chain that has already demonstrated its effectiveness against fully patched systems.