Ivanti Connect Secure Zero-Day Exploited for Arbitrary Command Execution
A critical zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure (ICS) is being actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary commands.
Ivanti has disclosed a severe zero-day vulnerability, tracked as CVE-2026-104935, affecting its Connect Secure (ICS) product. This high-severity flaw, rated with a CVSS score of 8.6, enables unauthenticated remote attackers to execute arbitrary commands on affected systems. Ivanti confirmed that a limited number of customers were targeted by exploitation attempts prior to the public disclosure.
The vulnerability is categorized under CWE-290, indicating an authentication bypass through spoofing. Attackers can exploit this flaw over a network without requiring any credentials or user interaction, making it a significant threat. The CVSS assessment highlights low attack complexity, with a high impact on data confidentiality and moderate impacts on data integrity and service availability.
According to Ivanti's advisory, the company's product security team initially identified a portion of this vulnerability and released a patch in version 25.1.3.0 in July 2026. However, exploitation began while Ivanti was working to integrate the fix into other supported versions of the software. The vendor credited Volexity for their assistance in protecting affected customers.
This incident follows a series of previous exploitation campaigns targeting Ivanti VPN products and a notable network breach involving Ivanti zero-days. It is important to note that these prior incidents involved different vulnerabilities and should not be directly linked to the methods or scope of the current exploitation campaign.
The vulnerability impacts several versions of Ivanti Connect Secure, including 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti has identified 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 as resolved versions. Versions within the 22.7 branch and lower are not affected by this specific vulnerability.
Ivanti has provided specific guidance for customers, recommending that those using 25.1.1.1 on ISA6000 or ISA8000 appliances should upgrade to 25.1.1.2. For users on the 22.8 branch, migration to 25.1.1.2 or later is advised, or alternatively, installing 22.8R2.5 if immediate migration is not feasible. Both the 22.7 and 22.8 branches are scheduled to reach end-of-life on January 31, 2027.
Migrating to version 25.1.3.0 requires specific hardware platforms (ISA4500, ISA6500, or ISA8500). Physical deployments will need new servers, while virtual and cloud deployments require newly built devices using the appropriate templates. Administrators are urged to consult Ivanti’s official upgrade and migration guide before proceeding with platform changes.
At the time of disclosure, Ivanti stated it had no reliable indicators of compromise (IOCs) and advised customers who suspect exploitation to follow their recovery instructions. The advisory did not attribute the attacks to any specific threat actor or provide detailed exploit information, leaving the full scope of the campaign beyond the confirmed customers uncertain.
Volexity's detailed analysis reveals that the threat actor UTA0576 chained an authentication bypass and RCE vulnerability (CVE-2026-104935) with a privilege escalation flaw to achieve unauthenticated root-level code execution. The actor specifically targeted Active Directory credentials, LAPS passwords, and BitLocker keys, while actively deleting forensic evidence from logs to evade detection.
This new report from Rapid7 details that threat actors are not only exploiting CVE-2026-104935 as a zero-day but are also leveraging an additional, unpatched privilege escalation vulnerability. Ivanti is planning to address this second flaw in a future update, indicating a multi-stage attack chain is being utilized against Ivanti Connect Secure devices.