Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products.
Volexity researchers, which discovered in-the-wild exploitation earlier this month, said attackers actually exploited three zero-days in a chain that allowed them to bypass authentication, execute code remotely and escalate privileges.
Ivanti disclosed and issued a patch for the authentication bypass and remote-code execution components of the exploit chain as a single vulnerability in Ivanti Connect Secure. The company said it initially discovered a portion of the high-severity vulnerability — CVE-2026-104935 — during internal security checks in June.
A threat actor, which Volexity tracks as UTA0576, exploited the defects before Ivanti addressed them and issued a patch.
“Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote in response to questions.