--- title: Ivanti patches Connect Secure zero-day after researchers... description: Ivanti has released patches for Connect Secure (ICS) addressing CVE-2026-104935, an authentication bypass rated 8.6 on CVSS that allows unauthenticated remote... canonical: https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks | daily.dev og:description: Ivanti has released patches for Connect Secure (ICS) addressing CVE-2026-104935, an authentication bypass rated 8.6 on CVSS that allows unauthenticated remote... og:url: https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7 og:image: https://api.daily.dev/og/posts/NuOLPLyt7.png og:image:alt: Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Ivanti has released patches for Connect Secure (ICS) addressing CVE-2026-104935, an authentication bypass rated 8.6 on CVSS that allows unauthenticated remote code execution and was actively exploited in the wild before the fix shipped. The flaw was discovered by Volexity, which tracked the intrusion activity to a new threat actor dubbed UTA0576, suspected of criminal rather than espionage motives, focused on credential theft, data exfiltration, log tampering, and reconnaissance. Attackers avoided malware or web shells, instead running commands directly through the exploit chain using hardcoded credentials in scripts, which Volexity suspects were generated with help from large language models. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. A separate, related privilege-escalation vulnerability in the same attack chain remains unpatched, with Ivanti promising a fix in the coming weeks. This marks the third consecutive year Ivanti has had to respond to actively exploited zero-days in Connect Secure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-104935 in Ivanti Connect Secure and is it being exploited? CVE-2026-104935 is an authentication bypass vulnerability in Ivanti Connect Secure (ICS), rated 8.6 on CVSS, that lets remote unauthenticated attackers execute arbitrary commands. Ivanti confirmed exploitation in the wild affecting a limited number of customers before patches shipped. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; Ivanti released fixes and urges running the Integrity Checker Tool. _Teams running Ivanti Connect Secure can track emerging CVEs like this one on daily.dev to patch before attackers strike._ ### Who is behind the recent Ivanti Connect Secure attacks and what were they after? Volexity tracks the threat actor as UTA0576, a previously unknown group suspected of criminal rather than espionage motives. Observed post-exploitation activity focused on credential theft, data exfiltration, log tampering, and network reconnaissance, with no malware or web shells deployed. Volexity assessed with high confidence the activity signaled preparation for lateral movement and broader network compromise, and suspects the attackers used large language models to support the operation. _Security researchers piecing together attacker tradecraft can follow writeups like this via daily.dev._ ### Is there still an unpatched vulnerability in Ivanti Connect Secure after the October 2026 update? Yes, a separate privilege-escalation flaw distinct from CVE-2026-104935 remains unpatched. It was part of a three-vulnerability attack chain described by Volexity, and Ivanti has only addressed the authentication bypass and remote code execution stages so far, with a fix for the privilege-escalation bug promised in the coming weeks. _Admins tracking outstanding Ivanti patches can stay on top of follow-up fixes through daily.dev._ ## Similar posts on daily.dev - [Ivanti patches critical Sentry flaws that lead to full device takeover](https://daily.dev/posts/ivanti-patches-critical-sentry-flaws-that-lead-to-full-device-takeover-uuwutwn8p) · CSO Online · 0 upvotes · 0 comments - [CVE-2026-10520, CVE-2026-10523 - Multiple critical vulnerabilities affecting Ivanti Sentry](https://daily.dev/posts/cve-2026-10520-cve-2026-10523---multiple-critical-vulnerabilities-affecting-ivanti-sentry-uxvwlkgex) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [Ivanti: Max severity Sentry flaw allows code execution as root](https://daily.dev/posts/ivanti-max-severity-sentry-flaw-allows-code-execution-as-root-h8hixzuel) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks","url":"https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7"},"datePublished":"2026-10-14T17:19:08.066Z","dateModified":"2026-10-14T21:46:16.977Z","description":"Ivanti has released patches for Connect Secure (ICS) addressing CVE-2026-104935, an authentication bypass rated 8.6 on CVSS that allows unauthenticated remote...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/734e14f70f08979233dd494fb9c22cc6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/734e14f70f08979233dd494fb9c22cc6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks-nuolplyt7#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-104935 in Ivanti Connect Secure and is it being exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-104935 is an authentication bypass vulnerability in Ivanti Connect Secure (ICS), rated 8.6 on CVSS, that lets remote unauthenticated attackers execute arbitrary commands. Ivanti confirmed exploitation in the wild affecting a limited number of customers before patches shipped. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; Ivanti released fixes and urges running the Integrity Checker Tool. Teams running Ivanti Connect Secure can track emerging CVEs like this one on daily.dev to patch before attackers strike."}},{"@type":"Question","name":"Who is behind the recent Ivanti Connect Secure attacks and what were they after?","acceptedAnswer":{"@type":"Answer","text":"Volexity tracks the threat actor as UTA0576, a previously unknown group suspected of criminal rather than espionage motives. Observed post-exploitation activity focused on credential theft, data exfiltration, log tampering, and network reconnaissance, with no malware or web shells deployed. Volexity assessed with high confidence the activity signaled preparation for lateral movement and broader network compromise, and suspects the attackers used large language models to support the operation. Security researchers piecing together attacker tradecraft can follow writeups like this via daily.dev."}},{"@type":"Question","name":"Is there still an unpatched vulnerability in Ivanti Connect Secure after the October 2026 update?","acceptedAnswer":{"@type":"Answer","text":"Yes, a separate privilege-escalation flaw distinct from CVE-2026-104935 remains unpatched. It was part of a three-vulnerability attack chain described by Volexity, and Ivanti has only addressed the authentication bypass and remote code execution stages so far, with a fix for the privilege-escalation bug promised in the coming weeks. Admins tracking outstanding Ivanti patches can stay on top of follow-up fixes through daily.dev."}}]} ```