Ivanti Connect Secure Zero-Day Exploited Before Patch Release
Ivanti customers are responding to another actively exploited zero-day affecting Ivanti Connect Secure, a security product frequently targeted by threat actors. Volexity researchers discovered the in-the-wild exploitation earlier this month and identified that attackers chained three zero-day vulnerabilities to bypass authentication, execute remote code, and escalate privileges on compromised devices.
The vulnerability chain includes CVE-2026-104935, which Ivanti said it discovered during internal security checks in June. Despite this early detection, the company did not issue an out-of-band patch because the flaw was not being actively exploited at the time and did not meet the threshold for immediate release. Instead, Ivanti scheduled the fix for its normal product release cycle.
However, threat actors exploited the vulnerability before Ivanti could release a patch. Volexity tracks the responsible threat actor as UTA0576, with the earliest confirmed instance of exploitation occurring on October 1. Researchers noted that activity may have begun as early as late September.
Attack Chain and Post-Exploitation Activities
According to Volexity, UTA0576 repeatedly exploited the chained vulnerabilities to compromise Ivanti Connect Secure VPN appliances and execute arbitrary commands. Post-exploitation activities included credential theft, dumping of Active Directory metadata, log tampering, and network reconnaissance. The attacker deployed custom malicious tools designed to facilitate follow-on attacks, including credential testing and hunting for administrator passwords and recovery keys.
"Based on Volexity’s observations, UTA0576 primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance,"
Ivanti has since issued a patch addressing the authentication bypass and remote-code execution components of the exploit chain as a single vulnerability. The company stated that it has fully addressed the unauthenticated remote code execution component, eliminating the primary exploitation path. Ivanti also confirmed it is developing additional updates to resolve the remaining vulnerabilities and strengthen product security.
CISA Response and Guidance
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on Tuesday. CISA urged Ivanti customers to patch immediately and warned that Ivanti’s Integrity Checker Tool may not detect exploitation because threat actor commands execute in memory, leaving no disk-based artifacts for the tool to identify.
"Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation,"
CISA also advised against relying solely on the Integrity Checker Tool for compromise assessment.
Broader Context and Risk to Edge Devices
Ivanti Connect Secure and related products have been frequent targets for attackers seeking initial access to networks. Since late 2021, CISA has flagged 36 Ivanti vulnerabilities in its Known Exploited Vulnerabilities catalog, with at least six exploited since late January.
Sean Koessel, vice president of professional services at Volexity, emphasized that edge devices like Ivanti Connect Secure are valuable footholds for attackers due to their network exposure and potential to pivot into internal networks. He warned that widespread exploitation is likely given the history of attacker interest in these products and the relative ease of exploiting the authentication bypass.
Yordan Ganchev, principal threat intelligence specialist at watchTowr, added that the race condition required for code execution offers minimal resistance, allowing unauthenticated attackers to repeatedly attempt exploitation until success. He concluded that widespread, indiscriminate exploitation is inevitable as attackers review patches and public disclosures.
Ivanti advised potentially affected customers to upgrade to the latest software version, run the Integrity Checker Tool regularly, and review indicators of compromise published by Volexity. The full scope of compromise remains under investigation, with Ivanti noting in its security advisory that a "limited number of customers" were compromised prior to disclosure.
Source: CyberScoop