As reported by BleepingComputer, CISA has confirmed active exploitation of a zero-day vulnerability in Ivanti Connect Secure (ICS) dating back to at least October 1st. The vulnerability, CVE-2026-104935, is being chained with additional flaws by a threat actor tracked as UTA0576 to achieve unauthenticated root-level code execution — a particularly dangerous combination for VPN gateway appliances that sit at the network perimeter.
Vulnerability Details
| Field | Details |
|---|---|
| CVE ID | CVE-2026-104935 |
| Severity | High (Ivanti rating) |
| Type | Authentication bypass / Remote Code Execution (combined in exploit chain) |
| Affected Product | Ivanti Connect Secure (ICS) |
| Patched Versions | 22.8R2.5, 25.1.3.0, 25.1.3.1, 25.1.1.2 |
| Exploitation | Confirmed in the wild since at least October 1, 2026 |
| Threat Actor | UTA0576 (unidentified; reported by Volexity) |
| Attack Complexity | Low — no user interaction required |
Why This Matters
Ivanti Connect Secure appliances are VPN gateways — they are the front door to enterprise networks. When an attacker achieves root-level execution on a VPN concentrator, they effectively bypass every perimeter control at once. What makes this campaign especially concerning is the post-exploitation activity: UTA0576 is actively hunting for Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This is credential harvesting at scale designed to enable lateral movement into the broader identity infrastructure.
With Shadowserver identifying over 5,600 internet-exposed ICS hosts, the attack surface is substantial. Given that exploitation began on October 1st and patches were only released on October 13th, organizations should assume a two-week window of exposure for any unpatched system.
Who Is Most at Risk
The exploit chain — authentication bypass, RCE, and privilege escalation — achieves unauthenticated root execution. This is not a theoretical risk; it is a confirmed, active campaign targeting the credentials that unlock your entire environment.
Shield53 Recommendations
Immediate Actions
- Patch now. Upgrade to ICS 22.8R2.5, 25.1.3.0, 25.1.3.1, or 25.1.1.2 immediately. Do not wait for maintenance windows.
- Hunt for compromise. Assume any ICS appliance that was internet-facing since October 1st may be compromised. Review logs for anomalous command execution, unexpected SSH sessions, and configuration changes.
- Rotate credentials. If compromise is suspected or confirmed, rotate all AD credentials, LAPS passwords, service account credentials, and BitLocker recovery keys stored in AD. Prioritize Domain Admin and tier-0 accounts.
- Check for web shells and persistence. VPN appliance compromises frequently involve malicious web shells or modified system binaries. Perform integrity checks against known-good baselines.
- Restrict internet exposure. If patching cannot be completed immediately, place ICS behind a reverse proxy or restrict access to known IP ranges as a temporary mitigation.
Detection Guidance
- Monitor ICS admin console access logs for unauthenticated or anomalous session activity
- Alert on outbound connections from ICS appliances to unknown external IPs
- Correlate with AD logins — watch for authentication attempts using credentials that may have been harvested from the appliance
- Check for new or modified scheduled tasks, startup scripts, and cron entries on the appliance
This is a perimeter compromise scenario with credential theft as the objective. Treat it as an active incident until you can confirm your environment is patched and uncompromised. CISA's deadline for federal agencies is Friday — every organization should treat that as their own deadline regardless of BOD applicability.
