Ivanti Connect Secure VPN Zero‑Day Exploited in the Wild, Patch Released for Two Flaws
securityweek.com reports that Ivanti warned customers that a zero‑day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild . securityweek.com reports that the vulnerability, tracked as CVE‑2026‑104935 and rated high severity, is an authentication bypass that allows unauthenticated remote code execution with elevated privileges . securityweek.com reports that Volexity discovered the exploitation, attributing it to threat actor UTA0576, which chained three zero‑days to achieve root‑level code execution on fully patched appliances, with evidence dating back to October 3 . securityweek.com reports that Ivanti has patched the authentication bypass and RCE bugs in ICS versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, while a third privilege‑escalation flaw remains unpatched and the vendor plans to fix it over the coming weeks .
Why it matters. securityweek.com reports that the attacks enabled theft of domain credentials and data exfiltration, exposing affected customers to ongoing security risks until the remaining flaw is patched .