Ivanti Connect Secure Zero-Day Exploited After Fix Was Scheduled for a Routine Update

Ivanti customers are dealing with another actively exploited zero-day in one of the vendor's most commonly targeted security products. Researchers at Volexity, who discovered the in-the-wild exploitation earlier this month, said attackers chained three zero-day flaws in Ivanti Connect Secure. The chain let them bypass authentication, run code remotely and escalate their privileges.

Ivanti has patched the authentication bypass and remote code execution parts of the chain, which it disclosed as a single high-severity vulnerability, CVE-2026-104935. The company said it found part of the issue during internal security checks in June. Because the flaw was found internally, was not being actively exploited and did not meet the threshold for an out-of-band release, Ivanti scheduled the fix for its normal release cycle. A threat actor tracked by Volexity as UTA0576 exploited the defects before the patch was issued. Ivanti says it is developing further updates to address the remaining vulnerability.

The full scope of compromise is still under investigation, though Ivanti's advisory says a limited number of customers were compromised before disclosure. Volexity's Sean Koessel said the earliest confirmed exploitation was on 1 October, but activity in late September would not surprise him. The US Cybersecurity and Infrastructure Security Agency has added the flaw to its known exploited vulnerabilities catalog.