Ivanti Connect Secure Zero-Day Exploitation
What is the Attack? FortiGuard Labs is monitoring active exploitation of multiple zero-day vulnerabilities affecting Ivanti Connect Secure (ICS), an enterprise remote access VPN solution. Threat actors have chained three vulnerabilities (CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527) to achieve unauthenticated root-level code execution on vulnerable appliances. According to security researchers, the attacks have been observed since at…
|
What is the Attack? |
FortiGuard Labs is monitoring active exploitation of multiple zero-day vulnerabilities affecting Ivanti Connect Secure (ICS), an enterprise remote access VPN solution. Threat actors have chained three vulnerabilities (CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527) to achieve unauthenticated root-level code execution on vulnerable appliances. According to security researchers, the attacks have been observed since at least October 1, 2026. The activity was initially attributed to a previously unidentified threat actor tracked by Volexity as UTA0576. The attack chain begins with CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without authentication. Attackers then leverage CVE-2026-111357 to escalate privileges and CVE-2026-118527 to upload attacker-controlled files to predetermined locations on the appliance. Once access is obtained, observed post-exploitation activities include credential theft, Active Directory reconnaissance, data exfiltration, and network scanning. Researchers also reported attempts to retrieve Windows Local Administrator Password Solution (LAPS) credentials and BitLocker recovery keys. Notably, the attackers reportedly deployed no malware or web shells. Instead, they re-exploited the appliance to execute individual commands and manipulated system logs to conceal their activity and evade Ivanti’s Integrity Checker Tool. Ivanti confirmed that exploitation affected a limited number of customers before disclosure. CISA has now added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. |
|
What is the recommended Mitigation? |
Ivanti Connect Secure appliances running the following versions are affected: Organizations using Ivanti Connect Secure should immediately apply the latest available security updates. Recommended actions: |
|
What FortiGuard Coverage is available? |
FortiGuard Labs continues to monitor exploitation attempts involving Ivanti Connect Secure and the associated attack techniques. FortiGuard customers should use multiple layers of defense to help identify and mitigate suspicious activity associated with the exploitation chain: |