Ivanti on Tuesday warned clients {that a} zero-day vulnerability in its Join Safe (ICS) VPN home equipment has been exploited within the wild.
Tracked as CVE-2026-104935 and rated excessive severity, the difficulty is an authentication bypass that lets a distant, unauthenticated attacker execute arbitrary instructions. Ivanti says it’s conscious of exploitation affecting a restricted variety of clients.
Volexity found the in-the-wild exploitation whereas investigating an incident at one in all its clients. A beforehand undocumented risk actor it tracks as UTA0576 had chained three zero-days to realize unauthenticated, root-level code execution on a completely patched ICS equipment.
In response to Volexity, CVE-2026-104935 covers two of the issues: an authentication bypass and a distant code execution bug. Ivanti has patched these vulnerabilities with the discharge of ICS variations 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.
The third vulnerability, a privilege escalation subject, stays unpatched, and the seller plans to repair it over the approaching weeks.
Volexity, which discovered proof of exploitation beginning on October 3, says UTA0576 centered totally on credential theft, knowledge exfiltration, community reconnaissance, and log tampering.
The attackers stole area credentials saved on the equipment and exfiltrated restricted Energetic Listing metadata. Utilizing a customized software, they searched Energetic Listing for LAPS passwords and BitLocker restoration keys.
Additionally they ran password-spraying assaults, examined credentials with a customized Kerberos software, and tried to extract credentials from captured community visitors. Additionally they scanned the community, collected the equipment’s configuration knowledge, and parsed authentication logs to establish legitimate usernames. Volexity discovered no backdoor or net shell on the system.
The operation was detected and disrupted earlier than the attackers’ final objectives turned clear. Volexity believes with excessive confidence that their actions pointed to preparation for lateral motion and a wider compromise of the community.
“Volexity assesses with low confidence that UTA0576 has prison, fairly than espionage, motivations primarily based on the goal of this exercise,” the corporate says.
“As with many different risk actor operations Volexity has investigated in 2026, Volexity assesses with medium confidence that UTA0576 makes use of enormous language fashions (LLMs) for exploit growth and post-exploitation exercise,” it added.
Associated: Vital SonicWall Vulnerability Exploited Days After Disclosure
Associated: Unpatched AhsayCBS Vulnerabilities Exploited within the Wild
Associated: Citrix Urges Quick Patching of Vital NetScaler Vulnerability
