"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," Ivanti wrote in its advisory.
CVE-2026-104935 and Ivanti's updates
On Tuesday Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication-bypass vulnerability that the vendor said allows remote, unauthenticated attackers to execute arbitrary commands. The flaw carries a CVSS score of 8.6. Ivanti said the Tuesday updates address the authentication bypass and remote code execution stages of the exploit chain, and advised customers to update Connect Secure and check for compromise.
Volexity's findings and the actor tracked as UTA0576
Security firm Volexity discovered the vulnerability and reported that the intrusions it observed were carried out by a previously unknown actor now tracked as UTA0576. Volexity said criminal motive, rather than espionage, is suspected. Based on observed post‑exploitation activity, the researchers wrote that attackers appeared chiefly interested in credential theft, data exfiltration, log tampering and network reconnaissance.
Notably, Volexity reported the attackers did not deploy malware or web shells; they ran only the commands available on the ICS appliance. The researchers also pointed to repeated use of the exploit channel to run commands, "highly specific scripts using hardcoded credentials," and even suspect the attackers were using large language models to support their work.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageAttack chain, the remaining privilege‑escalation bug, and timing
Ivanti disclosed a single CVE, but Volexity described an attack chain involving three vulnerabilities. Tuesday's updates cover the authentication bypass and remote code execution stages tied to CVE-2026-104935; a third vulnerability that enables privilege escalation is separate and — according to Volexity — Ivanti is aware of that additional bug and plans to publish a fix "in the coming weeks."
Ivanti said it had already identified and partially patched "a portion of this vulnerability" in July's 25.1.3.0 release and had been working to backport the same fix. Volexity reported that attackers began exploiting the vulnerability before that backporting work was complete.
Affected releases and immediate actions for Ivanti customers
Ivanti listed affected releases as:
- 25.1.1.1 and earlier
- 25.1.2.2 and earlier
- 22.8R2.4 and earlier
The vendor advised customers to apply the updates, run the Ivanti Integrity Checker Tool regularly, and consult Volexity's report for indicators of compromise; Ivanti also said there are limited indicators of compromise available at present. The vendor's advisory reiterated that exploitation had been observed in the wild against a limited number of customers at disclosure.
What this means for technologists, procurement leaders, and defenders
- Technologists and security teams: prioritize patching the listed Connect Secure releases, run the Ivanti Integrity Checker Tool, and investigate systems for signs of credential theft, log tampering, and the non‑malware command activity Volexity described.
- Procurement and asset managers: confirm which Connect Secure branches are in use (25.1.1.1/25.1.2.2/22.8R2.4 or earlier) and accelerate update schedules where required to close an authentication bypass that enables remote arbitrary command execution.
- Network defenders and incident responders: watch for exploitation patterns Volexity highlighted — repeated exploit‑channel command execution and scripts with hardcoded credentials — and prepare to follow up when Ivanti publishes the promised privilege‑escalation patch in the coming weeks.
This disclosure marks the third year running that Ivanti has had to respond to undisclosed flaws in Connect Secure: previous zero‑days were disclosed in January 2025 and January 2024, the latter having led to exploits affecting thousands of ICS appliances. In the intervening months, security observers also reported suspected Chinese espionage groups exploiting bugs in Endpoint Manager Mobile (EPMM) and critical flaws in Sentry.
Ivanti's fixes for CVE-2026-104935 close the immediate authentication bypass and remote code execution vectors, but Volexity's account and the outstanding privilege‑escalation bug underscore that affected customers must both apply patches and hunt for signs of earlier compromise while awaiting the forthcoming remediation.
