Ivanti Connect Secure VPN appliances face active zero-day exploitation

Researchers have identified a high-severity zero-day vulnerability, designated CVE-2026-104935, affecting Ivanti Connect Secure (ICS) VPN appliances. The flaw, which carries a CVSS score of 8.6, allows for authentication bypass and remote code execution (RCE).

Threat actor UTA0576 has been observed actively exploiting this vulnerability in the wild. The attackers utilize a multi-step chain, combining the authentication bypass with a file write and a privilege-escalation flaw to gain unauthorized root access. This chain allows attackers to execute arbitrary commands without credentials or user interaction.

Post-exploitation activities include the collection of sensitive data such as LDAP service credentials, LAPS local-administrator passwords, and BitLocker recovery keys. To evade detection, attackers have employed in-memory execution and anti-forensic techniques, including removing logs and restoring configuration stores to bypass integrity checkers. While Ivanti has released patches for the primary CVE, the privilege-escalation component used in these attacks remains unpatched, with a fix expected in a future release.