Ivanti patches Connect Secure zero-day after attackers reach fully patched VPNs
Ivanti disclosed and patched an actively exploited flaw in its Connect Secure VPN appliances after Volexity found attackers chaining it with two other zero-days to gain root access. Ivanti said a limited number of customers were compromised; the separate privilege-escalation flaw remains unpatched, and Volexity found evidence of credential theft, data exfiltration and network reconnaissance.
Bottom line — Ivanti has patched CVE-2026-104935, but the privilege-escalation flaw in the chain still needs a fix.
Go deeper 5
-
Volexity identified the actor, tracked as UTA0576, exploiting an appliance running version 22.8R2.4, which was fully patched at the time.
-
Volexity said the attackers stole credentials, searched Active Directory for administrator passwords and BitLocker recovery keys, and attempted password spraying.
-
The attackers tampered with logs and ran commands through repeated exploitation; Volexity found no web shell or backdoor.
-
Volexity said the device’s Integrity Checker Tool may miss this activity because the exploit altered memory and restored configuration data.
-
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue and urged affected organisations to patch.