Ivanti Connect Secure Zero-Day Exploited by Previously Unknown Attackers: Update and Check for Compromise

Ivanti has released updates for its Connect Secure (ICS) product to fix CVE-2026-104935, an authentication bypass flaw found by security firm Volexity. The flaw is rated 8.6 on the CVSS scale and lets remote attackers with no login run arbitrary commands. Ivanti said it is aware of exploitation affecting a limited number of customers, and that few indicators of compromise are available so far. It advised customers to read Volexity's report and to run the Ivanti Integrity Checker Tool regularly.

Ivanti said it had identified part of the vulnerability earlier and fixed it in July's 25.1.3.0 update. It had been backporting that fix to other releases, but attackers began exploiting the flaw before that work was finished. Volexity said the attackers were previously unknown to it and are now tracked as UTA0576. It suspects a criminal rather than espionage motive. The attackers appeared interested in credential theft, data exfiltration, log tampering and network reconnaissance.

Notably, the attackers deployed no malware and no web shells, using only commands available on the appliance. Volexity suspects they used large language models to support their work. It assessed with high confidence that the activity was preparation for lateral movement and a broader compromise of the victim network, though the attackers' final goals are unknown because the operation was disrupted. Volexity also described an attack chain involving three vulnerabilities. Ivanti's updates address the authentication bypass and remote code execution stages.