Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild.

Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti says it’s aware of exploitation affecting a limited number of customers.

Volexity discovered the in-the-wild exploitation while investigating an incident at one of its customers. A previously undocumented threat actor it tracks as UTA0576 had chained three zero-days to gain unauthenticated, root-level code execution on a fully patched ICS appliance.

According to Volexity, CVE-2026-104935 covers two of the flaws: an authentication bypass and a remote code execution bug. Ivanti has patched these vulnerabilities with the release of ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.

The third vulnerability, a privilege escalation issue, remains unpatched, and the vendor plans to fix it over the coming weeks.

Volexity, which found evidence of exploitation starting on October 3, says UTA0576 focused primarily on credential theft, data exfiltration, network reconnaissance, and log tampering.

The attackers stole domain credentials stored on the appliance and exfiltrated limited Active Directory metadata. Using a custom tool, they searched Active Directory for LAPS passwords and BitLocker recovery keys.

They also ran password-spraying attacks, tested credentials with a custom Kerberos tool, and tried to extract credentials from captured network traffic. They also scanned the network, collected the appliance’s configuration data, and parsed authentication logs to identify valid usernames. Volexity found no backdoor or web shell on the device.

The operation was detected and disrupted before the attackers’ ultimate goals became clear. Volexity believes with high confidence that their actions pointed to preparation for lateral movement and a wider compromise of the network.

“Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations based on the target of this activity,” the company says .

“As with many other threat actor operations Volexity has investigated in 2026, Volexity assesses with medium confidence that UTA0576 makes use of large language models (LLMs) for exploit development and post-exploitation activity,” it added.

Related : Critical SonicWall Vulnerability Exploited Days After Disclosure

Related : Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Related : Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

Adobe Patches 140 Vulnerabilities Across 10 Products

The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.

Google Partially Reverses Chrome Bug Bounty Cuts

Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.

Critical SonicWall Vulnerability Exploited Days After Disclosure

CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.

Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.

Cisco Patches a Dozen Critical Vulnerabilities

The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.