Ivanti Connect Secure is currently facing active exploitation of multiple zero-day vulnerabilities, as confirmed by Volexity researchers who reported in-the-wild attacks earlier this month. The vulnerabilities, which allow attackers to bypass authentication, execute code remotely, and escalate privileges, have already compromised a limited number of Ivanti customers.
Volexity identified that attackers, tracked as UTA0576, exploited a chain of three zero-days before Ivanti could issue a patch. The company disclosed a high-severity vulnerability, CVE-2026-104935, which was initially discovered during internal security checks in June. An Ivanti spokesperson stated that the vulnerability did not meet the threshold for an out-of-band release, leading to its inclusion in the normal product release cycle.
Despite the patch for the authentication bypass and remote code execution components being issued, the full scope of the compromise remains under investigation. Ivanti acknowledged that a “limited number of customers” were compromised prior to the disclosure. The Cybersecurity and Infrastructure Security Agency (CISA) has since added the defect to its known exploited vulnerabilities catalog.
Details of the Exploitation
According to Volexity, the earliest confirmed instance of exploitation occurred on October 1, with indications that activity may have begun as early as late September. The researchers observed a series of post-exploitation activities involving a compromised Ivanti Connect Secure VPN appliance, where UTA0576 executed commands, extracted stored credentials, and deployed malicious tools for further attacks.
“Based on Volexity’s observations, UTA0576 primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance,” the company noted. Ivanti has urged customers to upgrade to the latest software version and utilize its Integrity Checker Tool, although CISA has advised against relying solely on this tool for detecting exploitation, as threat actor commands may execute in memory.
Implications for Ivanti Customers
Ivanti products, including Ivanti Connect Secure, have been frequent targets for attackers, with CISA flagging 36 Ivanti defects in its known exploited vulnerabilities catalog since late 2021. The nature of edge devices, which Ivanti products represent, makes them valuable footholds for attackers seeking to pivot deeper into networks. Volexity’s Sean Koessel emphasized that widespread exploitation is likely, given the common vulnerabilities associated with edge devices.
Other cybersecurity experts share similar concerns. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, noted that the trivial nature of the authentication bypass makes it likely that attackers will rapidly exploit the vulnerabilities as they review patches and public information. “The race condition required for code execution offers little resistance, as an unauthenticated attacker can repeatedly attempt exploitation until it succeeds,” he stated.
As the situation develops, Ivanti continues to work on additional updates to address the remaining vulnerabilities and enhance product security. Organizations are advised to conduct thorough network and memory forensics to identify any evidence of exploitation, as the threat landscape surrounding Ivanti Connect Secure remains precarious.
For further details, refer to CyberScoop.
