CVE-2026-104935 was discovered internally by Ivanti in June, yet Volexity says attackers were exploiting it in the wild by Oct. 1.
What Volexity found: a three‑zero‑day chain and UTA0576 activity
Researchers at Volexity reported that attackers chained three zero‑day flaws to defeat Ivanti Connect Secure authentication, achieve unauthenticated remote code execution and then escalate privileges. In its blog post, Volexity said the threat actor it tracks as UTA0576 “repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it.”
During the investigation into a customer’s compromised appliance, Volexity observed the actor extract credentials stored on the device, dump and steal Active Directory metadata, and deploy “multiple custom and malicious tools capable of facilitating follow‑on attacks, credential testing and hunting for administrator passwords, recovery keys and other passwords.” The company added that UTA0576 “primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance.”
Ivanti’s timeline, discovery and patching decision
Ivanti told reporters it discovered a portion of the high‑severity issue — CVE-2026-104935 — during internal security checks in June. Because the company concluded the issue “was not being actively exploited” at that time, “a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote.
After Volexity identified exploitation in October, Ivanti disclosed and issued a patch addressing the authentication bypass and remote‑code execution components of the exploit chain as a single vulnerability in Ivanti Connect Secure. The company said it “has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path,” and that “We are also developing additional updates to address the remaining vulnerability and further strengthen product security.”
Ivanti’s advisory also stated a “limited number of customers” were compromised prior to disclosure and that the full scope of compromise remains under investigation.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCISA’s action and the limits of local detection
The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog on Tuesday and urged Ivanti customers to patch quickly. In its alert, CISA warned that “Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation.”
CISA explicitly cautioned against relying solely on Ivanti’s Integrity Checker Tool, stating: “Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.” Ivanti nonetheless encouraged customers to upgrade to the latest version, run the Integrity Checker Tool regularly, and review indicators of compromise published by Volexity.
How technologists, procurement teams, and affected customers are likely to respond
- Technologists and security teams will need to prioritize patch deployment and undertake network and memory forensics rather than rely solely on the vendor tool, following CISA’s guidance.
- Procurement and risk teams at affected enterprises will face decisions about accelerated patch cycles and may press vendors for faster out‑of‑band fixes, given Ivanti’s explanation that the June discovery did not meet their threshold for an emergency release.
- Affected customers should assume credential theft and follow‑on activity is possible where appliances were compromised, because Volexity observed attackers extracting credentials, stealing Active Directory metadata and deploying tools for further access and reconnaissance.
Threat context and expected trajectory
Ivanti Connect Secure and other Ivanti products have been a frequent target at the network edge: CISA has flagged 36 Ivanti defects on its known exploited vulnerabilities catalog since late 2021, with at least six defects exploited since late January. Sean Koessel, vice president of professional services at Volexity, said it “would be fair to expect widespread exploitation” for edge‑device vulnerabilities and noted edge devices “are a valuable initial foothold and often enable attackers to pivot further into targeted networks.”
Other researchers see rapid exploitation ahead. Yordan Ganchev of watchTowr warned that “widespread, indiscriminate exploitation is inevitable as attackers begin reviewing patches and public information,” adding that “The race condition required for code execution offers little resistance, as an unauthenticated attacker can repeatedly attempt exploitation until it succeeds.”
The immediate record is narrow but consequential: a vulnerability discovered internally in June, a decision to include the fix in a normal release cycle, and attackers exploiting multiple zero‑days by early October to steal credentials and probe networks. Ivanti has closed what it calls the primary exploitation path and is preparing further updates; CISA and Volexity have urged rapid patching and forensic review. The full scope of compromises remains under investigation.
