Ivanti Connect Secure zero-day exploited since early October, attacker evades detection tool

Ivanti disclosed on October 13, 2026 that a zero-day authentication bypass vulnerability in its Connect Secure SSL VPN gateway, tracked as CVE-2026-104935, is being actively exploited in the wild — and that the attacker behind it has been running the campaign since at least October 1, nearly two weeks before the public warning went out. The flaw affects Connect Secure (ICS) versions 22.8R2.4 and earlier, along with the 25.1.x branch.

What the vulnerability allows

The bug lets an unauthenticated remote attacker run arbitrary commands on the appliance, with no user interaction required and low attack complexity — the kind of combination that turns an internet-exposed VPN gateway into an open door. Security firm Volexity, which discovered and reported the flaw, tracks the group exploiting it as UTA0576. According to Volexity, the actor didn’t use this bug alone: it chained CVE-2026-104935 with two additional flaws to achieve unauthenticated, root-level code execution on devices that were otherwise fully patched.

Ivanti has shipped fixes for two of the three vulnerabilities in that chain. A privilege escalation flaw that completes the exploit path remains unpatched as of this writing, meaning the available fix reduces but does not fully close the attack surface.

Anti-forensic tradecraft

What distinguishes this campaign from routine VPN exploitation is the attacker’s evasion work. UTA0576 deployed no malware and no web shell — the usual artifacts defenders look for after a compromise. Instead, Volexity observed the actor re-exploiting the device fresh for each command it wanted to run, and actively altering device logs to erase evidence of its activity. The group also evaded Ivanti’s own Integrity Checker Tool, the utility organizations are told to run to confirm their appliance hasn’t been tampered with — meaning a clean Integrity Checker scan on an affected device cannot be treated as proof of safety.

Scale of exposure

Internet-scanning service Shadowserver counts more than 5,500 Connect Secure instances reachable from the public internet, though it’s unclear how many of those are decoys, honeypots, or already remediated. Separately, researcher Defused reported seeing exploitation signals as early as October 1, suggesting the true start of the campaign may predate even Volexity’s October 3 estimate.

What organizations should do

Ivanti is urging administrators to upgrade to a fixed version immediately and to treat the Integrity Checker Tool as one signal among several rather than a definitive clearance, given the attacker’s demonstrated ability to evade it. Because the exploit chain’s third component remains unpatched, organizations running Connect Secure should assume continued risk even after applying the available fixes, and should review logs and device state for signs of compromise dating back to early October — not just from the disclosure date forward.

Enterprise VPN gateways have been a recurring target throughout 2026 precisely because they sit at the network perimeter with privileged access to everything behind them; this incident follows a now-familiar pattern of nation-state-linked and financially motivated actors chaining multiple vulnerabilities to defeat both authentication and the vendor’s own detection tooling in a single campaign.

As reported by BleepingComputer, based on research from Volexity and Ivanti’s own security advisory.