Ethical Hacking News
A zero-day vulnerability has been discovered in Ivanti Connect Secure, a widely used Industrial Control System (ICS) management software, allowing remote and unauthenticated attackers to execute arbitrary commands. This latest incident highlights the ongoing threat landscape for ICS systems and underscores the need for increased awareness and adoption of security measures to protect these systems.
Ivanti Connect Secure has been hit with a zero-day vulnerability, allowing remote and unauthenticated attackers to execute arbitrary commands. The vulnerability, CVE-2026-104935, was discovered by researchers at Volexity and has been confirmed to be in-the-wild. Attackers behind the recent intrusions are believed to be UTA0576, a previously unknown threat actor suspected of criminal motives. The patch for the authentication bypass stage is available, but the fix for the separate privilege-escalation flaw is unclear. This is the third year in a row that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure. The incident highlights the growing concern for ICS security and the need for increased awareness and adoption of security measures.
Ivanti Connect Secure, a widely used Industrial Control System (ICS) management software, has been hit with a zero-day vulnerability, allowing remote and unauthenticated attackers to execute arbitrary commands. This latest incident highlights the ongoing threat landscape for ICS systems, which are increasingly becoming a target for cyber-attacks.
The vulnerability, CVE-2026-104935, was discovered by researchers at Volexity and has been confirmed to be in-the-wild, with attackers already exploiting it to gain unauthorized access to ICS appliances. According to Volexity, the attackers behind the recent intrusions are believed to be UTA0576, a previously unknown threat actor suspected of criminal motives rather than espionage.
The Ivanti patches released on Tuesday aim to address the authentication bypass and remote code execution stages of the vulnerability, but it is unclear when the fix for the separate privilege-escalation flaw will be available. The vendor has promised to publish a fix for this additional bug in the coming weeks.
This incident is the third year in a row that Ivanti has had to deal with attackers exploiting undisclosed flaws in Connect Secure. The previous ICS zero-days were disclosed in January 2025 and January 2024, with those incidents affecting thousands of ICS appliances.
The growing concern for ICS security is underscored by the fact that researchers have identified a suspected Chinese espionage group exploiting bugs in Endpoint Manager Mobile (EPMM) and critical flaws in Sentry. Additionally, the recent discovery of a zero-day vulnerability in SharePoint has highlighted the ongoing threat landscape for on-premises systems.
In response to the growing threat landscape, researchers and vendors are advocating for increased awareness and adoption of security measures, such as regular patching and vulnerability scanning. However, the fact that attackers are still able to exploit these vulnerabilities suggests that more needs to be done to protect ICS systems.
The incident serves as a reminder that ICS systems are increasingly becoming a target for cyber-attacks, and that it is essential for vendors and users to prioritize security and take proactive measures to protect these systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Ivanti-Connect-Secure-Zero-Day-Vulnerability-A-Growing-Concern-for-Industrial-Control-Systems-ehn.shtml
https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095
https://www.hipaajournal.com/ivanti-connect-secure-zero-day-2026/
Published: Wed Oct 14 13:22:29 2026 by llama3.2 3B Q4_K_M
