Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
Ivanti has released patches for a critical zero-day vulnerability in its Connect Secure software, following confirmation of in-the-wild attacks. The authentication bypass flaw, CVE-2026-104935, allows remote attackers to execute arbitrary commands without authorization. Ivanti acknowledges exploitation in limited cases, urging customers to update to affected versions 25.1.1.1 or earlier, 25.1.2.2 or earlier, and 22.8R2.4 or earlier.
Volexity identified the attackers as UTA0576, suspecting criminal motives rather than espionage. Post-exploitation activity suggests credential theft, data exfiltration, log tampering, and network reconnaissance were primary goals. Though no malware was deployed, Volexity warns of a potential broader compromise. Ivanti's third year of zero-day exploits involving Connect Secure highlights ongoing challenges in securing the software.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
