Ivanti VPN Vulnerability Subject to Active Exploits
A new critical flaw enables root-level access on VPN appliances, complicating security efforts for enterprise networks.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust that enterprise software companies prioritize security over feature release speed?
Attackers are actively exploiting a critical, unauthenticated remote code execution vulnerability in Ivanti Connect Secure VPN appliances. The flaw, identified as CVE-2026-104935, allows for root-level access when chained with a separate, currently unpatched privilege-escalation vulnerability.
Why it matters
The active exploitation of critical infrastructure VPNs poses a significant risk to enterprise network security. While patches for the primary flaw are available, the presence of an unpatched privilege-escalation bug limits the efficacy of partial remediation efforts.
The vulnerability CVE-2026-104935 carries an 8.6 CVSS score, indicating high severity due to its potential for remote code execution. This score measures exploitability and impact, though it remains below the maximum 10.0 scale for critical-severity flaws.
The players
Ivanti
A software company providing enterprise networking and security hardware, including the Connect Secure line of VPN appliances.
UTA0576
A threat actor identified as actively leveraging the vulnerability to achieve root-level persistent access in compromised environments.
The details
Attackers using the alias UTA0576 execute an attack chain that combines CVE-2026-104935 with an unpatched privilege-escalation flaw—a secondary vulnerability that allows a user to gain higher access rights than they are normally permitted. Once initial access is gained, the threat actors utilize in-memory execution to run malicious code directly in volatile memory rather than on disk, coupled with anti-forensic techniques designed to bypass security logging and detection systems.
Timeline
October 20, 2026: Security researchers reported on the active exploitation of the vulnerability.
The Tech Race
The exploitation of Ivanti Connect Secure appliances continues a trend of threat actors specifically targeting VPN gateways as high-value perimeter entry points. This incident highlights the ongoing technical race between vendor security hardening and the development of sophisticated multi-stage exploit chains.
Organizations utilizing Ivanti Connect Secure VPNs should immediately apply the available patches for CVE-2026-104935 to mitigate remote code execution risks. Security teams must remain alert for indicators of compromise, as the secondary unpatched privilege-escalation flaw may still permit unauthorized access even after the primary patch is applied.
The takeaway
The security of enterprise VPNs continues to be a high-risk area, especially when multiple vulnerabilities are chained to bypass traditional defenses. IT administrators should prioritize monitoring these systems for unusual in-memory activity until a patch for the secondary privilege-escalation flaw is issued.
Further reading
For broader trends in network defense, see our Cybersecurity section.
Live Poll
Do you trust that enterprise software companies prioritize security over feature release speed?
