Loading story…
Ivanti disclosed active exploitation of CVE-2026-104935, a high-severity authentication-bypass vulnerability in Connect Secure that allows remote, unauthenticated attackers to execute arbitrary commands. The flaw carries a CVSS score of 8.6 and was exploited against a limited number of customers before disclosure. CISA confirmed exploitation and added it to its Known Exploited Vulnerabilities catalog. Volexity reported that attackers also used a separate, still-unpatched privilege-escalation vulnerability; the supplied reports do not identify the attackers.
Ivanti lists 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 as fixed releases and states that versions 22.7.x and earlier are unaffected. Version 25.1.3.0 included an initial fix in July, with remaining updates released on October 5 as remediation extended across supported versions. Organizations should treat affected appliances as an emergency patching priority, follow platform-specific migration requirements, and investigate possible compromise even after updating. Ivanti recommends reviewing Volexity’s published indicators, regularly running its Integrity Checker Tool, and following its recovery procedures when exploitation is suspected; patching alone should not be treated as evidence that an appliance is uncompromised.
See which actors are running it and whether you're in range.
11 events from the most recent confirmed update back to the earliest known activity.
As of October 14, 2026, Previdian had recorded 105 exploitation attempts against its honeypots from 50 unique IP addresses geolocated to Singapore and the United States. Captured payloads used Perl scripts disguised as ZIP files primarily to test remote code execution rather than deploy malware.
CISA confirmed exploitation of CVE-2026-104935 in the wild and added it to its Known Exploited Vulnerabilities catalog.
Ivanti published an advisory describing a CVSS 8.6 authentication bypass that allows unauthenticated remote attackers to execute arbitrary commands on affected Connect Secure appliances. It confirmed pre-disclosure exploitation affecting a limited number of customers and identified fixed releases.
Ivanti released 22.8R2.5 to resolve CVE-2026-104935 for customers on the 22.8 release line who could not immediately migrate to 25.1.1.2 or later.
Ivanti released version 25.1.1.2 to resolve CVE-2026-104935 in the applicable release branch. It recommended the update for customers running 25.1.1.1 on ISA6000 or ISA8000 appliances.
Volexity detected threat actor activity in early October 2026 involving exploitation of CVE-2026-104935 and a separate, still-unpatched privilege escalation vulnerability. The authentication bypass was exploited before public disclosure.
Ivanti patched a portion of CVE-2026-104935 in the July 2026 release of Connect Secure 25.1.3.0 after discovering it through its product security program. Fixes for other supported release branches were still being backported when exploitation occurred.
CISA ordered Federal Civilian Executive Branch agencies to remediate CVE-2026-104935 by October 16, 2026, and urged all affected organizations to patch immediately. Warning that in-memory execution could evade Ivanti's Integrity Checker Tool, CISA recommended network and memory forensics, rebuilding or resetting compromised appliances, and rotating credentials and secrets.
Volexity reported that researchers disrupted the Connect Secure exploitation campaign before it could progress further. Researchers assessed that the attacker was preparing for lateral movement and broader compromise of the environment.
Volexity identified UTA0576 as the actor repeatedly exploiting a then-fully-patched Connect Secure 22.8R2.4 appliance beginning October 3, 2026, using an authentication bypass chained with an unpatched local privilege-escalation flaw. The operation included traffic capture, credential harvesting, Active Directory reconnaissance, and password spraying while evading Ivanti's Integrity Checker Tool.
Volexity published an analysis detailing attackers' use of CVE-2026-104935 alongside a separate, unpatched privilege escalation vulnerability. It also published indicators of compromise to support investigations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
19 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcethehackernews.com
Open sourceacn.gov.it
Open sourceboho.or.kr
Open sourcehub.ivanti.com
Open sourcecve.org
Open sourcebankinfosecurity.com
Open sourceforums.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Volexity discovered UTA0576 actively exploiting three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, including a fully patched device running version 22.8R2.4, Build 19097. The attacker chained authentication bypass, remote code execution, and privilege escalation to gain unauthenticated root-level execution. The authentication bypass and remote code execution components are tracked as **CVE-2026-104935**, for which Ivanti released patches on October 13, 2026; a separate privilege-escalation fix remained pending. UTA0576 stole credentials, queried Active Directory for sensitive information, captured network traffic, conducted password spraying, and exfiltrated data through the exploit channel without installing a persistent backdoor or web shell. Memory-only modifications, configuration restoration, selective log deletion, and artifact cleanup concealed the activity and limited the effectiveness of Ivanti’s disk integrity checker. Volexity assessed that the operation prepared for lateral movement and broader compromise, but it was disrupted before the attacker’s ultimate objectives became clear. Defenders should prioritize the available patches and investigate credential abuse and downstream compromise rather than relying solely on disk integrity checks.
Oct 14, 2026
Ivanti remediated **CVE-2025-0282**, a CVSS 9.0 unauthenticated remote-code-execution flaw affecting Ivanti Connect Secure and Policy Secure appliances. Ivanti warned that the vulnerability was being actively exploited, and public proof-of-concept code was released, increasing the risk of opportunistic compromise. The company also fixed **CVE-2025-0283**, a CVSS 7.0 local privilege-escalation vulnerability. Organizations should apply Ivanti’s updates immediately and use the Ivanti Integrity Checker Tool to identify indicators of compromise. Where compromise is detected, Ivanti advises resetting affected appliances to factory defaults and following its recovery process; defenders should also monitor surrounding networks and credentials for malicious activity or persistence.
Aug 31, 2026
Attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, chaining authentication bypass CVE-2023-46805 with command injection CVE-2024-21887 to execute arbitrary commands without authentication. Volexity reported active exploitation, while Ivanti confirmed limited customer exploitation. The vendor’s expanded advisory covers five vulnerabilities affecting Connect Secure, Policy Secure and, for certain flaws and deployment conditions, Neurons for ZTA gateways. Ivanti reported that fewer than 20 customers were affected before public disclosure by exploitation involving the original pair and CVE-2024-21893. **Patches are available**, but Ivanti also recommends factory resetting hardware appliances or rebuilding virtual appliances to address potential attacker persistence. Defenders should use Ivanti’s External Integrity Checker Tool alongside continuous security monitoring: attackers have attempted to manipulate the internal integrity checker, and clean integrity-check results do not rule out earlier compromise. Remediation should therefore address both vulnerable software and possible persistent access rather than treating patch installation alone as evidence that an appliance is safe.
Oct 3, 2026