Vulnerabilities · 1h ago

Ivanti Connect Secure exploit added to KEV

Volexity said UTA0576 is actively exploiting CVE-2026-104935 in Ivanti Connect Secure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Ivanti also shipped fixes for the authentication-bypass and remote code execution parts of the chain, while a separate privilege-escalation bug is still pending.

The chain lets an attacker make the appliance treat a request as already authenticated, then turn that into arbitrary command execution and root. Volexity said the compromise sat largely in memory and the attacker wiped Ivanti debug and Linux audit logs, so a patched gateway can still hide a past intrusion from routine checks.

For teams that use Connect Secure as the trust gate to internal networks and Active Directory, the open question is not just whether the box is patched but whether it was already used to harvest credentials or other secrets. If that happened, the exposure can extend beyond the appliance into downstream identity systems even after the VPN itself is updated.

CVE-2026-104935

NVD KEV

Known exploited · CISA KEV

CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

CISA federal remediation date Oct 16

Timeline

Sources

17 sources covering this story

Entities

Vendor digest: Ivanti

Part of the PlainSec briefing for 2026-10-14

Editions

Related stories