Ivanti Zero-Day Exploit Chain Actively Targets Connect Secure VPN Appliances
Ivanti customers are responding to a newly disclosed zero-day exploit chain affecting Ivanti Connect Secure, a widely used security product. Researchers at Volexity identified in-the-wild exploitation earlier this month, revealing that attackers leveraged three zero-day vulnerabilities to bypass authentication, execute remote code, and escalate privileges.
Ivanti disclosed and patched two components of the exploit chain an authentication bypass and remote code execution (RCE) under CVE-2026-104935, initially discovered during internal security checks in June. However, the threat actor tracked as UTA0576 exploited the flaws before patches were released. Ivanti stated that while the primary exploitation path has been mitigated, additional updates are in development to address remaining vulnerabilities.
The earliest confirmed exploitation occurred on October 1, though activity may have begun in late September. Volexity’s investigation into a compromised Ivanti Connect Secure VPN appliance revealed that UTA0576 conducted credential theft, data exfiltration, log tampering, and network reconnaissance. The attacker extracted stored credentials, dumped Active Directory metadata, and deployed custom tools for follow-on attacks.
Ivanti confirmed that a "limited number of customers" were compromised before disclosure. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog on Tuesday, warning that Ivanti’s Integrity Checker Tool may not detect exploitation due to in-memory command execution. CISA advised organizations to conduct network and memory forensics for accurate detection.
Ivanti products, particularly edge devices like Connect Secure, remain high-value targets for attackers. Since late 2021, CISA has flagged 36 Ivanti vulnerabilities in its catalog, with six exploited since January 2024. Researchers warn that widespread exploitation is likely, given the trivial nature of the authentication bypass and the low resistance of the RCE race condition.
Source: https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/
Ivanti TPRM report: https://www.rankiteo.com/company/ivanti
"id": "iva1791938012",
"linkid": "ivanti",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Limited number of customers',
'industry': 'Cybersecurity',
'name': 'Ivanti',
'type': 'Vendor'}],
'attack_vector': 'Exploitation of zero-day vulnerabilities in Ivanti Connect '
'Secure VPN appliances',
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Stored credentials',
'Active Directory metadata']},
'date_detected': '2023-10-01',
'description': 'Ivanti customers are responding to a newly disclosed zero-day '
'exploit chain affecting Ivanti Connect Secure, a widely used '
'security product. Researchers at Volexity identified '
'in-the-wild exploitation earlier this month, revealing that '
'attackers leveraged three zero-day vulnerabilities to bypass '
'authentication, execute remote code, and escalate privileges.',
'impact': {'brand_reputation_impact': True,
'data_compromised': True,
'identity_theft_risk': True,
'operational_impact': ['Credential theft',
'Data exfiltration',
'Log tampering',
'Network reconnaissance'],
'systems_affected': ['Ivanti Connect Secure VPN appliances']},
'initial_access_broker': {'entry_point': 'Ivanti Connect Secure VPN '
'appliances'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': ['Patches released',
'Additional updates in '
'development'],
'root_causes': ['Zero-day vulnerabilities in '
'Ivanti Connect Secure']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Conduct network and memory forensics for accurate '
'detection',
'Apply patches for CVE-2026-104935',
'Monitor for further exploitation'],
'references': [{'source': 'Volexity'},
{'source': 'Ivanti'},
{'source': 'CISA'}],
'regulatory_compliance': {'regulatory_notifications': ['CISA Known Exploited '
'Vulnerabilities '
'Catalog']},
'response': {'containment_measures': ['Patches released for two '
'vulnerabilities (CVE-2026-104935)',
'Additional updates in development'],
'remediation_measures': ['Network and memory forensics advised '
'by CISA'],
'third_party_assistance': 'Volexity'},
'threat_actor': 'UTA0576',
'title': 'Ivanti Zero-Day Exploit Chain Actively Targets Connect Secure VPN '
'Appliances',
'type': ['Zero-Day Exploit',
'Authentication Bypass',
'Remote Code Execution',
'Privilege Escalation'],
'vulnerability_exploited': ['CVE-2026-104935 (Authentication Bypass & RCE)',
'Additional undisclosed zero-day vulnerabilities']}