Cybersecurity
Ivanti warns of Connect Secure zero-day attacks
Ivanti told customers to patch a zero-day in Connect Secure, while Volexity said a group it tracks as UTA0576 had used the flaw in a chain that reached root-level code execution.
- Ivanti urged customers on Tuesday to patch CVE-2026-104935 in Connect Secure and said it was aware of limited exploitation.
- The flaw affected Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
- Volexity said UTA0576 had used the flaw from at least 3 October with two other vulnerabilities to run code on fully patched devices.
- Defused said it saw the first signs of exploitation from 1 October, and Shadowserver said more than 5,500 Connect Secure instances were exposed online.
- Ivanti said it was still working on a privilege escalation issue that UTA0576 had used in the same chain.
Ivanti told customers on Tuesday to install fixes for a zero-day in Connect Secure. It said the issue was being used in limited attacks and advised users to upgrade and run the Integrity Checker Tool regularly.
The flaw, tracked as CVE-2026-104935, affected versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti said remote attackers without privileges could use it in low-complexity attacks to run commands on the appliances.
Volexity said it found and reported the flaw. It said a threat actor it tracks as UTA0576 had used CVE-2026-104935 from at least 3 October together with two other flaws to gain unauthorised root-level code execution on fully patched devices.
Volexity said the actor did not deploy malware or a web shell, but reused the device for each command and altered logs to hide the activity. Defused said it saw the first signs of exploitation from 1 October, while Shadowserver said more than 5,500 Connect Secure instances were exposed online, although it did not know how many were honeypots or already secured.
Named in this story
Companies
- Ivanti
- urged customers to patch the flaw and said it had seen limited exploitation
- Volexity
- found and reported the flaw and said UTA0576 had exploited it
- Defused
- said it saw the first signs of exploitation from 1 October
Organisations
- Shadowserver
- tracked more than 5,500 exposed Connect Secure instances online
- UTA0576
- the threat actor Volexity said chained the flaw with two others
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- flagged 36 Ivanti vulnerabilities as actively exploited since November 2021
Products and systems
- Ivanti Connect Secure
- the remote access gateway affected by the vulnerability
- Integrity Checker Tool
- the tool Ivanti told customers to run regularly
How the source tells it
The register was that of a plain security advisory with a brisk urgent edge, driven by patch-now language and descriptions of ongoing exploitation.
- urgency The patch guidance used immediate-action language and repeated calls to upgrade as soon as possible
- threat The flaw was described as actively exploited, with remote command execution and root-level compromise