CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA warns of Ivanti Connect Secure zero-day flaw exploited by UTA0576.
Run Ivanti?
Get an email when a reviewed story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
CISA has issued an urgent warning for Ivanti Connect Secure (ICS) systems, highlighting a critical authentication bypass vulnerability (CVE-2026-104935) being exploited as a zero-day since at least October 1st. Threat actor UTA0576 is chaining this flaw with others to achieve unauthenticated root-level code execution, targeting Active Directory credentials and sensitive data. CISA has ordered federal agencies to patch immediately and advised all organizations to update and investigate for signs of compromise.
The lesson from this incident
Full lessonA critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited as a zero-day by threat actor UTA0576, who chains it with additional flaws to achieve unauthenticated root-level code execution. The attack has been ongoing since at least October 1st, giving adversaries significant dwell time to harvest Active Directory credentials and exfiltrate sensitive data before defenders were alerted. This incident underscores the danger of unpatched internet-facing VPN and remote access appliances, which serve as high-value entry points into enterprise networks. CISA's emergency directive to federal agencies reflects the severity of the risk, and all organizations — public and private — should treat this as a critical, time-sensitive threat.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
- cve — CVE-2026-104935
- cve — CVE-2023-46805