What Happened

Ivanti disclosed CVE-2026-104935, a high-severity zero-day vulnerability in Connect Secure VPN that permits unauthenticated remote attackers to execute arbitrary commands. Active exploitation has been confirmed since October 1, 2026, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, urging immediate remediation.

The vulnerability is part of a chain of three zero-days, with two patched and one fix pending. Threat actor UTA0576 has been observed executing commands and stealing credentials without leaving a backdoor, and reliable indicators of compromise are currently unavailable.

Who Is Affected

Ivanti Connect Secure VPN customers running versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are affected. CISA's KEV listing also mandates remediation for federal agencies and creates compliance pressure for enterprises that follow the catalog.

Market Impact

This zero-day drives immediate demand for patching, threat hunting, and incident response services across Ivanti's enterprise customer base, especially in the US where CISA involvement escalates urgency.

• Urgent patch management and vulnerability remediation workflows are triggered.
• Credential theft without a backdoor creates demand for EDR/XDR and forensic investigation services.
• No reliable IOCs forces organizations to rely on behavioral analysis and expert threat hunting.

What to Watch

Watch for the pending zero-day fix in the chain and any additional exploitation activity linked to UTA0576. Also monitor public disclosures of compromised Ivanti deployments, as credential theft may lead to follow-on intrusions and data breach announcements.

Related coverage

• CISA Confirms Critical Zero-Day Exploits in Citrix NetScaler ADC and Gateway
• Ransomware crews exploit critical JetBrains TeamCity RCE flaw CVE-2026-63077
• GitLab Issues Critical Patch for CVSS 10.0 RCE Vulnerability CVE-2026-97229
• Critical CVE-2026-91140 in Progress DataDirect ARCGenAI Agents Patched