Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti has disclosed an actively exploited zero-day vulnerability, CVE-2026-104935, in its Connect Secure (ICS) remote access gateway, affecting multiple versions. The flaw allows unauthenticated remote attackers to execute arbitrary commands without user interaction. A threat actor tracked as UTA0576 has been exploiting this vulnerability since at least October 3, 2026, chaining it with two other unpatched flaws to achieve unauthenticated root-level code execution on fully patched devices, while avoiding detection by tampering with logs and not deploying traditional malware or web shells.

AI-extracted · verify before operational use