CISA Lists Ivanti Zero-Day Flaw as Actively Exploited After Chain Attack

CISA added the flaw to the known exploited catalog Tuesday. The defect is tracked as CVE-2026-104935 with a CVSS score of 8.6 and affects Ivanti Connect Secure software versions before 25.1.3.0.

Researchers found attackers chaining three zero-days, which are flaws used before a fix exists, to bypass security and run commands remotely. This flaw allows a remote user without login access to gain root control over the system.

Ivanti has patched two parts of the exploit chain but a third privilege escalation issue remains unpatched. The vendor says it plans to fix the remaining vulnerability over the coming weeks.

Reports differ on when the attacks first occurred in the wild. Volexity researchers stated earliest confirmed activity was Oct 1, while another report cited evidence starting October 3. Ivanti said they discovered part of the flaw internally during June security checks.

The threat actor UTA0576 stole credentials and looked for recovery keys stored on the device. Researchers say with medium confidence that the group uses large language models to help develop exploits.

CISA warned that the vendor Integrity Checker Tool may not detect the attack because commands run directly in computer memory. Investigators said organizations will need network forensics to find evidence of compromise.

A federal directive orders agencies to fix the flaw by October 16, 2026. Private organizations are also urged to review the vulnerability catalog and update their systems.