Ivanti Patches Actively Used Connect Secure Flaw Enabling Unauthenticated Commands
Ivanti has disclosed a high-severity vulnerability in Connect Secure that is under active exploitation. The flaw has a CVSS score of 8.6 and allows unauthenticated attackers to bypass authentication and run commands on vulnerable VPN appliances. Volexity discovered the issue while investigating a compromised Ivanti Connect Secure system.
Ivanti Connect Secure is a VPN appliance, and CVE-2026-104935 carries a CVSS score of 8.6. The company says exploitation has been limited but observed in the wild, and it has advised users of affected systems to act. Volexity found the issue while examining a compromised appliance that had current patches installed.
The intrusion involved UTA0576, a previously unidentified actor. According to the available account, the actor combined this authentication bypass and command-execution flaw with another privilege-escalation zero-day to reach root. From there, the campaign sought credentials, Active Directory information, LAPS passwords, BitLocker recovery keys, and other data useful for moving laterally.
Organizations that use Ivanti Connect Secure for remote access, along with their employees, customers, and partners, could be affected if the flaw is exploited. Attackers may use compromised appliances to reach internal networks, obtain credentials or recovery keys, and move laterally. That could lead to data theft, service disruption, or costly incident response. The episode may also push security teams to prioritize patching and monitoring of internet-facing VPN systems, since these devices often sit at the boundary between public networks and sensitive internal resources.