Affected Systems
Ivanti Connect Secure (ICS) versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Over 5,500 ICS instances exposed online. Affects SSL VPN appliances used for remote access to corporate and cloud resources.
Exploitation Status
Active exploitation confirmed since at least October 3, 2026 by threat actor UTA0576. Volexity and Defused observed exploitation in the wild. Attacker chains CVE-2026-104935 with two other flaws for unauthenticated root-level code execution. No malware deployed; attacker re-exploits device per command and tampers with logs to evade Ivanti Integrity Checker Tool.
Business Impact
High-severity authentication bypass allows remote unauthenticated attackers to execute arbitrary commands on ICS appliances with low complexity and no user interaction. Provides direct entry point to enterprise networks and access to sensitive corporate data. Ivanti products have history of zero-day exploitation by APT groups and ransomware gangs (CISA has flagged 36 Ivanti vulnerabilities as exploited since 2021). Log tampering techniques evade built-in detection tools. One vulnerability in the exploit chain remains unpatched.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade all Ivanti Connect Secure appliances to patched versions per Ivanti security advisory SA-2026-104935
- Run Ivanti Integrity Checker Tool regularly, but note it may not detect this specific attack due to log tampering by UTA0576
- Review ICS appliance logs from October 1, 2026 onward for signs of compromise; coordinate with Volexity IOCs if available
- If immediate patching is not possible, isolate ICS appliances from internet exposure or place behind additional authentication layers
- Monitor for Ivanti's patch release for the third unpatched privilege escalation vulnerability in the exploit chain