IVANTI reported that two zero-day flaws in its Ivanti Connect Secure (ICS) hardware and software were exploited in the wild, centring on a high-severity authentication bypass combined with unauthenticated remote code execution (RCE) in SSL-VPN and remote‑access gateways. The vulnerabilities are tracked collectively under CVE-2026-104935.
Ivanti said it had “discovered a portion of this vulnerability” in July via its product security programme and released a fix in ICS version 25.1.3[.]0, while backporting the patch to older, still-supported versions proved uneven as exploitation began to occur.
Volexity researchers identified a zero-day exploit chain used by the threat actor tracked as UTA0576, which achieved unauthorised root‑level code execution by chaining the authentication bypass, the RCE, and an as‑yet undisclosed privilege-escalation flaw. The chain affected ICS appliances even when they appeared fully patched, highlighting the difficulty of ensuring all supported versions receive fixes promptly.
Ivanti noted the discovery was partially tied to its LLM project, which scans for vulnerabilities and suggests remediations, but the rapid exploitation underscored a broader issue: the patch backport window can create dangerous gaps across versions in the field. CISA added CVE-2026-104935 to KEV, with federal agencies given a deadline to mitigate by 16 October, either by updating or disabling affected appliances.
Detecting exploitation remains challenging, as some indicators rely on memory‑patching in vulnerable devices rather than straightforward log or configuration changes.