CISA has told admins to immediately patch a newly exploited Ivanti Connect Secure flaw, CVE-2026-104935, after confirming active zero-day attacks since 1 October. For UK teams running ICS as their remote access front door, this is the latest entry in a worrying vendor pattern — see cyber security services.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| CVE-2023-46805 / 21887 | 0 | 2 |
| CVE-2024-21893 | 2 | 2 |
| CVE-2025-0282 | 52 | 4 |
| CVE-2025-22457 | 62 | 4 |
| CVE-2026-104935 | 140 | 4 |
Another zero-day, another urgent patch window
CISA's advisory confirms CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure, has been exploited in the wild since at least 1 October 2026. The flaw lets an unauthenticated remote attacker execute arbitrary commands on vulnerable appliances in a low-complexity attack that needs no user interaction — about as bad as a VPN gateway bug gets.
Ivanti released fixed versions 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2 on Tuesday, warning customers to act immediately given limited but confirmed exploitation in the wild.
What CVE-2026-104935 lets attackers do
Because the bug sits in the authentication layer, exploitation doesn't require stolen credentials or social engineering — attackers go straight to arbitrary command execution on internet-facing ICS systems. For UK organisations, that means any unpatched, exposed appliance is a live target the moment this advisory lands, not a theoretical future risk.
This is precisely the scenario that makes perimeter remote-access gear so dangerous when a vendor-specific zero-day emerges: a single flaw, publicly disclosed, against a known and fingerprintable product class.
Inside the attack chain: credential and secrets theft
Cybersecurity firm Volexity reports a threat actor it tracks as UTA0576 has been chaining CVE-2026-104935 with two other Ivanti flaws since at least 3 October, combining the authentication bypass with a remote code execution bug and a privilege escalation issue to reach unauthenticated, root-level code execution.
Volexity's investigation found the attacker going after Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys — exactly the material needed to pivot from a breached edge device into full domain compromise. Threat intel firm Defused independently confirmed exploitation, saying it first observed CVE-2026-104935 abuse on 1 October. This is the kind of lateral-movement risk managed detection & response is designed to catch before it reaches the domain controller.
Exposure at scale and the federal deadline
Shadowserver's internet scans now count more than 5,600 internet-exposed hosts carrying ICS fingerprints, though it's unclear how many of those remain unpatched versus already secured or deliberately run as honeypots.
CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue and ordered US federal civilian agencies to remediate by Friday under its Binding Operational Directive 26-04. That directive doesn't bind UK organisations, but CISA's parallel advisory to all network defenders — patch immediately and hunt for compromise — applies just as directly to any Servnet client running ICS at the network edge.
- •CISA's forensic warning: Ivanti's Integrity Checker Tool may not detect this compromise because the threat actor's commands run in memory, not on disk
- •Organisations must instead conduct network and memory forensics to confirm whether they were exploited
Why Ivanti's track record changes the risk calculus
This isn't an isolated incident. Ivanti Connect Secure has now suffered a string of zero-days exploited in the wild — CVE-2023-46805 and CVE-2024-21887 in early January 2024, CVE-2024-21893 two weeks later, CVE-2025-0282 in January 2025, and CVE-2025-22457, exploited by China-linked actors since at least mid-March 2025. CISA has added 36 Ivanti vulnerabilities to its exploited-flaws list since November 2021, 12 of which have also been used in ransomware attacks.
For UK buyers, that history matters as much as any single CVE score. Repeated exploited zero-days in the same product line signal a structural, vendor-specific risk in remote access infrastructure — a factor worth weighing in procurement and renewal decisions, not just in patch cadence. It's also a strong argument for architecting remote access around zero trust principles rather than relying on a single perimeter appliance as the sole gatekeeper.
View the data behind this chart
| Layer | Detail |
|---|---|
| Authentication bypass | CVE-2026-104935 lets unauthenticated access to ICS |
| Remote code execution | Also covered under CVE-2026-104935; chained RCE flaw executes attacker commands |
| Privilege escalation | Separately-tracked third flaw escalates to root-level access — remains unpatched |
| Unauthenticated root access | Full control of the appliance achieved |
| Credential and secrets theft | AD credentials, LAPS passwords, BitLocker keys targeted |
What UK infrastructure teams should do now
Patch to 22.8R2.5, 25.1.3.0, 25.1.3.1 or 25.1.1.2 without delay, then assume compromise is possible on any appliance that was internet-exposed before the patch landed. Note that this patch addresses only the authentication bypass and remote code execution components of the UTA0576 chain — per Volexity's research, as reported by SecurityWeek and The Hacker News, the privilege-escalation flaw that elevates attackers to root remains unpatched, with Ivanti saying a fix is still weeks away. Organisations should not assume full remediation until that fix ships. CISA's recommended response for confirmed or suspected compromise is thorough and should be followed in order, not skipped to save time.
Given the credential and secrets theft seen in this campaign — AD credentials, LAPS passwords, BitLocker keys — rotating identity material is as important as patching the appliance itself. Teams weighing whether to retain single-vendor remote access gear long-term, or diversify their edge stack, may find it useful to review options as part of a broader infrastructure resilience review, and to model the cost of accelerated remediation using the IT finance calculator. If you need help validating exposure or running incident response now, talk to a Servnet engineer.
- •Back up appliance configuration before any remediation action
- •Factory reset (or rebuild for virtual/cloud instances) and upgrade to the latest ICS version
- •Restore configuration from the pre-reset backup
- •Reset passwords for all domain, administrator and local accounts
- •Revoke and reissue certificates; reset stored API keys and license server credentials