Ivanti has disclosed an actively exploited zero-day vulnerability in its Connect Secure (ICS) remote access gateway that could allow attackers to run commands on affected systems.
Tracked as CVE-2026-104935, the flaw allows remote attackers to bypass authentication without needing user interaction or special access. It affects several ICS versions, including 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
Ivanti said it is aware of limited attacks exploiting the vulnerability and is working with affected organizations. The company advised customers to upgrade to a fixed version, review its security advisory, and regularly run its Integrity Checker Tool.
Cybersecurity firm Volexity, which discovered the flaw, reported that a threat actor, tracked as UTA0576, has been exploiting it since at least October 3. The attackers combined the vulnerability with two other flaws to gain root-level access to devices.
“Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys,” the company said.
According to Volexity, instead of using malware or web shells the attackers exploited the devices to run commands and altered logs to hide malicious activity, allowing them to evade Ivanti's security checks.
Threat actors extracted credentials stored on the ICS VPN appliance, such as domain credentials used with LDAP, dumped and exfiltrated limited Active Directory metadata. They also deployed a custom Kerberos tool capable of Kerberoast attacks and credential testing, as well as a custom Python LDAP tool to search Active Directory for LAPS local administrator passwords, BitLocker recovery keys, and password-bearing attributes via a compromised Active Directory service account.
Ivanti has fixed two flaws involved in the attacks but is still working to address a third vulnerability related to privilege escalation.