Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

Ivanti disclosed CVE-2026-104935, a combined authentication-bypass and unauthenticated remote-code-execution flaw in Ivanti Connect Secure SSL-VPN gateways, after confirming active exploitation against a limited set of customers. Notably, Ivanti had already found part of this bug back in July through its AI-assisted vulnerability-hunting program and fixed it in ICS 25.1.3.0, but attackers struck while the company was still backporting the patch to older supported versions. Researchers at Volexity attribute the attacks to a group tracked as UTA0576, which chained the bug with an as-yet-unpatched privilege-escalation flaw to gain root-level code execution on fully updated appliances, harvest credentials, and move into Active Directory before being detected. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 16 to patch or disable affected devices, while experts warn the 8.6 CVSS score understates the real-world risk given the internet-facing exposure and active in-the-wild exploitation.