A critical vulnerability, identified as CVE-2026-104935, is actively being exploited in Ivanti Connect Secure VPN appliances, allowing attackers to bypass authentication and execute remote code. This high-severity flaw enables unauthorized access and command execution without credentials or user interaction, according to a recent report by Smarter MSP.
The vulnerability, with a CVSS score of 8.6, has been exploited by threat actor UTA0576 in conjunction with a separate privilege-escalation flaw to achieve root access. This attack chain allows for the execution of malicious code, elevation of privileges, and evasion of detection through in-memory execution and anti-forensic techniques. Successful exploitation grants attackers root-level access, potentially leading to credential theft, unauthorized network access, data exfiltration, and further compromise of internal systems. Ivanti has released patches for CVE-2026-104935, but the privilege-escalation vulnerability remains unpatched, increasing the urgency for organizations running affected appliances to apply security updates immediately and plan for migration from legacy versions.
Source: Smarter MSP
