Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild.

Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands. Ivanti says it’s aware of exploitation affecting a limited number of customers.

Volexity discovered the in-the-wild exploitation while investigating an incident at one of its customers. A previously undocumented threat actor it tracks as UTA0576 had chained three zero-days to gain unauthenticated, root-level code execution on a fully patched ICS appliance.

According to Volexity, CVE-2026-104935 covers two of the flaws: an authentication bypass and a remote code execution bug. Ivanti has patched these vulnerabilities with the release of ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.

The third vulnerability, a privilege escalation issue, remains unpatched, and the vendor plans to fix it over the coming weeks.

Volexity,...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE