Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

According to The Register, the flaw is rated 8.6 on the CVSS scale[1] and allows remote, unauthenticated attackers to execute arbitrary commands.[1]SecurityWeek reports that the threat actor Volexity tracks as UTA0576 had chained three zero-days to gain unauthenticated, root-level code execution on a fully patched ICS appliance.[3] The Register says the third bug, a privilege-escalation flaw, is still unpatched, and that Volexity expects Ivanti to fix it "in the coming weeks."[1]Ivanti told Help Net Security that it found part of the flaw itself and "patched it in the July release 25.1.3.0"[4], and that it "had been working to backport the fix to the remaining supported versions when exploitation occurred."[4]Volexity told BleepingComputer that "UTA0576 deployed no malware or web shell."[2] According to daily.dev, Volexity suspects the attackers used large language models to support the operation.[5]CyberScoop reports that CISA said "Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."[6]According to Pasquale Pillitteri, CISA added the flaw to its catalog of actively exploited vulnerabilities with an October 16 deadline for federal agencies.[7]BleepingComputer reports that Shadowserver now tracks over 5,500 ICS instances exposed online[2].