Affected Systems

Ivanti Connect Secure (ICS) versions prior to 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. Over 5,600 Internet-exposed ICS hosts identified globally. All unpatched ICS appliances are vulnerable to unauthenticated remote code execution.

Exploitation Status

Active exploitation confirmed since at least October 1, 2026. Threat actor UTA0576 chaining CVE-2026-104935 with two other flaws for unauthenticated root-level code execution. Attacks target Active Directory credentials, LAPS passwords, and BitLocker recovery keys. Volexity and Defused have confirmed ongoing campaigns.

Business Impact

Authentication bypass enables remote attackers to execute arbitrary commands without credentials or user interaction. Post-exploitation activity includes credential theft, data exfiltration, and compromise of domain secrets. Ivanti's Integrity Checker Tool cannot detect exploitation because commands execute in memory—network and memory forensics required. Federal agencies under BOD 26-04 must patch by October 18, 2026. This is the 36th exploited Ivanti vulnerability since 2021; 12 have been used in ransomware attacks.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade Ivanti Connect Secure to version 22.8R2.5, 25.1.3.0, 25.1.3.1, or 25.1.1.2 depending on your deployment branch
  • Conduct network and memory forensics on all ICS appliances to identify exploitation evidence; do not rely solely on Ivanti Integrity Checker Tool
  • If compromise is detected: backup appliance config, perform factory reset, upgrade to latest version, restore config, then reset all passwords and revoke/reissue certificates and API keys
  • Hunt for indicators of UTA0576 activity: unauthorized access to Active Directory credentials, LAPS password queries, and BitLocker recovery key access
  • Restrict Internet exposure of ICS appliances where possible and monitor authentication logs for anomalous command execution or privilege escalation