Ivanti recently faced a critical situation as two zero-day vulnerabilities were exploited in its Connect Secure products. These vulnerabilities, identified as CVE-2026-104935, involve a high-severity authentication bypass and remote code execution within the SSL-VPN and remote-access gateway. Despite Ivanti's efforts to address part of this vulnerability through a patch released in July, threat actors managed to exploit the unpatched versions. A threat actor group, known as UTA0576, was discovered by Volexity researchers using a zero-day exploit chain that compromised fully patched ICS appliances. The chain included an authentication bypass, remote code execution, and a privilege escalation vulnerability, allowing unauthenticated root-level code execution. While Ivanti is working on addressing the undisclosed privilege escalation flaw, the exploitation has led to unauthorized access, credential extraction, and other post-compromise activities, highlighting the importance of timely and comprehensive patch deployment. Douglas McKee from Rapid7 emphasized the critical challenge of ensuring that fixes are applied across all versions before attackers can exploit them. The Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2026-104935 in its Known Exploited Vulnerabilities catalog, urging federal agencies to mitigate the flaw by mid-October. Although the vulnerability holds a CVSS score of 8.6, experts warn that its real-world impact is more severe due to active exploitation and its presence on internet-facing devices. Security teams are advised to prioritize addressing this vulnerability to prevent further exploitation.