As reported by BleepingComputer, Ivanti has disclosed an actively exploited zero-day vulnerability in its Connect Secure (ICS) SSL VPN gateway, tracked as CVE-2026-104935. This high-severity authentication bypass affects multiple version branches and has been under attack since at least October 1, according to threat intelligence firm Defused, with Volexity attributing the activity to a previously unknown actor designated UTA0576.
What makes this disclosure particularly concerning is not just the zero-day itself, but the operational sophistication of the threat actor. Volexity reports that UTA0576 chained CVE-2026-104935 with two additional flaws — one of which remains unpatched — to achieve unauthenticated root-level code execution on fully patched devices. More critically, the actor deployed no persistent malware or web shells, instead re-exploiting the vulnerability for each command and tampering with logs to evade Ivanti's Integrity Checker Tool. This is fileless tradecraft at its most disciplined, and it fundamentally undermines the assumption that running a vendor-provided integrity tool is sufficient to confirm a clean device.
Vulnerability Details
| Field | Details |
|---|---|
| CVE ID | CVE-2026-104935 |
| Severity | High (CVSS score not yet published) |
| Affected Products | Ivanti Connect Secure (ICS) — versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, 25.1.1.1 and earlier |
| Attack Complexity | Low — no user interaction required, remote unauthenticated exploitation |
| Exploitation Status | Actively exploited in the wild since at least October 1–3, 2026 |
| Patch Available | Partial — Ivanti has patched CVE-2026-104935 and one secondary flaw; a privilege escalation vulnerability in the exploit chain remains unpatched |
| Threat Actor | UTA0576 (unidentified, tracked by Volexity) |
| Exposed Instances | ~5,500+ ICS instances exposed online (per Shadowserver) |
Why This Matters
Ivanti Connect Secure — formerly Pulse Connect Secure — sits at the network perimeter and serves as a primary entry point for remote workforces. A root-level compromise of this appliance gives an attacker an implicit trusted position inside the network, effectively bypassing the entire VPN authentication model. From there, lateral movement to identity providers, Active Directory, and cloud infrastructure is trivially accelerated.
Ivanti's track record makes this worse. The product family has been repeatedly targeted by zero-day exploits over the past several years, including widespread attacks that chained multiple flaws for malware deployment. This pattern signals that ICS appliances are now a persistent priority target for both state-sponsored and financially motivated actors. Organizations should treat Ivanti VPN infrastructure as Tier-0 crown jewel assets — equivalent in sensitivity to domain controllers.
The absence of deployed malware or web shells means traditional EDR and integrity-checking approaches may fail to detect this intrusion. The attacker re-exploited for every command and tampered with logs — a discipline that demands network-based detection, not just host-based tooling.
Who Is at Risk
Immediate Actions
- Patch now. Upgrade to the latest fixed version released by Ivanti. Do not delay for maintenance windows — this is an active, in-the-wild exploit chain.
- Run the Ivanti Integrity Checker Tool — but understand its limitations. Volexity confirmed UTA0576 evaded it through log tampering and fileless techniques. A clean ICT result does not guarantee a clean device.
- Review logs for anomalies dating back to at least October 1. Look for unexpected authentication bypass patterns, anomalous session activity, and signs of log truncation or manipulation.
- Deploy network-level detection. Since the attacker avoided host-based artifacts, network flow analysis, VPN session anomaly detection, and egress monitoring are your best bets for identifying post-exploitation activity.
- Restrict ICS exposure. If the appliance does not need to be internet-facing, place it behind a zero-trust access proxy or restrict access via IP allowlisting. Over 5,500 exposed instances is an unacceptable attack surface.
- Assume compromise and prepare for incident response. Given the fileless nature of the attack and the unpatched privilege escalation in the chain, treat any affected appliance as potentially compromised until forensic review is complete.
Shield53 Recommendations
Do not rely solely on vendor integrity tools for breach assessment. This incident proves that sophisticated actors can operate beneath their detection threshold. Instead, implement a layered verification approach: correlate VPN session logs with downstream identity provider logs (e.g., Okta, Entra ID) to detect sessions that originate from the VPN but lack corresponding authentication events. Monitor for unusual command execution patterns on internal systems that correlate with VPN session timestamps. And critically, plan for the reality that the exploit chain is not yet fully patched — the unpatched privilege escalation means even patched devices may remain vulnerable to the complete attack chain. Organizations should consider temporarily restricting ICS access to only essential users while the full patch set is available.
For the broader strategic picture: this is yet another reminder that perimeter VPN appliances are not sustainable as long-term zero-trust access solutions. Enterprises should accelerate migration toward zero-trust network access (ZTNA) architectures that eliminate the implicit trust model that makes these gateway compromises so devastating.
