Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products. 

Volexity researchers, which discovered in-the-wild exploitation earlier this month, said attackers actually exploited three zero-days in a chain that allowed them to bypass authentication, execute code remotely and escalate privileges. 

Ivanti disclosed and issued a patch for the authentication bypass and remote-code execution components of the exploit chain as a single vulnerability in Ivanti Connect Secure. The company said it initially discovered a portion of the high-severity vulnerability — CVE-2026-104935 — during internal security checks in June.

A threat actor, which Volexity tracks as UTA0576, exploited the defects before Ivanti addressed them and issued a patch.

“Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote in response to questions.

“Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path,” the spokesperson added. “We are also developing additional updates to address the remaining vulnerability and further strengthen product security.”

The full scope of compromise remains under investigation. The company, in a security advisory, said a “limited number of customers” were already compromised prior to disclosure. 

The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog Tuesday.

Sean Koessel, vice president of professional services at Volexity, said the earliest confirmed instance of exploitation occurred Oct. 1. Yet, “it wouldn’t surprise us if there was activity toward the end of September,” he added.

Volexity researchers observed a series of post-exploitation activities during an investigation involving a customer’s compromised Ivanti Connect Secure VPN appliance earlier this month. “UTA0576 repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it,” the company wrote in a blog post. 

The threat actor extracted credentials stored on the device, dumped and stole Active Directory metadata, and deployed multiple custom and malicious tools capable of facilitating follow-on attacks, credential testing and hunting for administrator passwords, recovery keys and other passwords.

“Based on Volexity’s observations, UTA0576 primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance,” the company added.

Ivanti encouraged potentially vulnerable customers to act immediately by upgrading to the latest version of software, running the company’s Integrity Checker Tool regularly, and reviewing indicators of compromise published by Volexity.

CISA also urged Ivanti customers to patch the vulnerability quickly, as it dissuaded customers from relying on the company’s Integrity Checker Tool.

“Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation,” the agency said in an alert Tuesday. “Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.”

Ivanti products, including Ivanti Connect Secure, are a frequent target for attackers of various motivations in the network edge space. 

CISA has flagged 36 Ivanti defects on its known exploited vulnerabilities catalog since late 2021. At least 6 defects across Ivanti products have been exploited since late January.

“Edge devices are a valuable initial foothold and often enable attackers to pivot further into targeted networks,” Koessel said. “It would be fair to expect widespread exploitation, this is a common theme with most vulnerabilities in edge devices.”

Other researchers also expect exploitation to pick up rapidly. 

“Given the history of attacker attention and focus Ivanti Connect Secure has previously drawn — and the trivial nature of the authentication bypass — widespread, indiscriminate exploitation is inevitable as attackers begin reviewing patches and public information,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.

“The race condition required for code execution offers little resistance, as an unauthenticated attacker can repeatedly attempt exploitation until it succeeds,” he added.