Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.

Even when technology vendors discover vulnerabilities before threat actors do, they can still fall victim to zero-day attacks.

That’s the unfortunate situation Ivanti found itself in this week, as attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure (ICS) products: a high-severity authentication bypass vulnerability and the follow-on ability for unauthenticated remote code execution (RCE) in the SSL-VPN and remote-access gateway. The cybersecurity vendor yesterday disclosed both flaws collectively as CVE-2026-104935.

“We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure,” Ivanti said in its advisory.

But the situation is more complicated than your typical zero-day scenario. According to the advisory, Ivanti actually “discovered a portion of this vulnerability” in July through the vendor’s product security program, and patched it with the ICS version 25.1.3.0 release. “We had been working to backport the fix to the remaining supported versions when exploitation occurred,” Ivanti said.

Volexity researchers discovered that a threat actor, tracked as UTA0576, was using a zero-day exploit chain earlier this month that included CVE-2026-104935. The chain compromised ICS appliances that were fully patched at the time.

It’s unclear what portion of CVE-2026-104935 Ivanti discovered over the summer, but an Ivanti spokesperson confirmed the discovery was made via Ivanti’s LLM project, which uses several frontier and open source AI models to find and automatically remediate vulnerabilities in the company’s products. But while AI models helped Ivanti get a head start on CVE-2026-104935, it appears threat actors were able to act even quicker.

Multiple Zero-Days Exploited Against Ivanti ICS Instances

Volexity researchers first detected the malicious activity on Oct. 5 while investigating an incident at “a network security monitoring customer,” according to a blog post published Tuesday. A forensic investigation revealed that an ICS appliance was the root cause of the attack that began on Oct. 3, and that UTA0576 used a zero-day exploit chain to compromise the device.

“This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution” Volexity researchers wrote. “The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.”

The privilege escalation flaw has not been disclosed. Volexity said Ivanti is currently working on a fix for the vulnerability and it will be patched in a future update.

UTA0576 actors extracted credentials from the ICS appliance and then engaged in a variety of post-compromise activities, from accessing the organization’s Active Directory to deleting exploitation evidence from Ivanti debug logs. Volexity researchers said because the attack was detected and disrupted, it’s unclear what UTA0576’s ultimate objective was.

What is clear, according to Douglas McKee, director of vulnerability intelligence at Rapid7, are the challenges facing vendors today for not just finding vulnerabilities before attackers do, but also fully addressing them before they can be exploited.

“Finding the bug is only part of the job,” he tells Dark Reading. “Ivanti found a portion of this, fixed it in the newest release back in July, and then had to carry that same fix back across every older supported version still running in the field. That backport window is exactly where this went sideways, because the fix existed but hadn’t reached everywhere it needed to be by the time attackers showed up.”

McKee emphasized that a quiet fix to one version could be a loud signal to attackers. “Attackers pay close attention to what a vendor changes, and an unpatched gap across supported versions is an open invitation to find the same issue somewhere the patch hasn’t landed,” he says.

Vendors are improving at finding their own vulnerabilities, McKee says, which is a positive development. But he stressed that the exploitation clock starts the minute any fix is released. “Closing the distance between ‘we have a fix’ and ‘every customer has the fix’ is where a lot of this risk actually lives, and to be fair, is a very hard challenge we have always faced,” he says.

CVE-2026-104935: Risks & Mitigations

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, and gave federal civilian agencies until Oct. 16 to mitigate the flaw, either by updating to a fixed version or disabling appliances.

While CVE-2026-104935 received only a high-severity CVSS score of 8.6, McKee says the flaw is extremely serious and should be prioritized by security teams.

“What the number can’t tell you is that this is already being exploited in the wild as a zero-day, it lives on an Internet-facing VPN appliance, and attackers are chaining it with a second bug,” he says. “Those are the things that should be driving how fast organizations move, and together they push the practical risk well above what 8.6 reads like on paper.”

Volexity researchers noted that a spoofed HTTP request with ICS’s X-DSCGI-PATH internal routing header can exploit the flaw, but warned that threat actors will likely “identify additional paths that can either be used as the URL or header target for this exploit.” The researchers recommended monitoring for mismatches between the URL path and X-DSCGI-PATH.

However, detecting exploitation of CVE-2026-104935 may be a challenge. While Ivanti encouraged customers to run its Integrity Checker Tool (ICT), Volexity researchers said the ICT tool may not detect modifications to a device “because this exploit chain patches library code in memory only and restores configuration store data.” The threat intelligence company said network and memory forensic investigations are required to identify exploitation activity.