Ivanti Connect Secure Zero-Day Chain Gives Attackers Unauthenticated Root Access Since October 1 (CVE-2026-104935)

Scope: Ivanti Connect Secure (ICS) remote access gateway appliances

Severity: Red

CISA is urging administrators to patch CVE-2026-104935 immediately after threat intelligence firms Volexity and Defused both confirmed active zero-day exploitation dating back to at least October 1, 2026. This flaw is actually a chain, an authentication bypass combined with a remote code execution and privilege escalation path, that together let a remote attacker with zero privileges execute arbitrary commands on the device with no user interaction required. CISA says attackers are using it for credential theft and data exfiltration. What makes this one harder to clean up than usual is that Ivanti’s own Integrity Checker Tool, the recommended method for confirming whether a device was compromised, may not detect it at all, because attacker commands run entirely in memory rather than touching disk. Organisations running Ivanti Connect Secure must apply the patch immediately and should not treat a clean Integrity Checker Tool result as proof the device is safe, independent log review for credential theft and data exfiltration indicators is necessary regardless of that tool’s output.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.