Critical Ivanti VPN Flaw Under Active Attack: What CISOs Need to Know About CVE-2026-104935
In October 2026, CISA issued urgent warnings after threat actors actively exploited CVE-2026-104935, a critical authentication bypass vulnerability in Ivanti Connect Secure VPN appliances. The zero-day flaw allowed remote attackers to execute arbitrary commands without authentication, leading to credential theft and data exfiltration. Security researchers documented over 105 exploitation attempts from coordinated attackers, with the criminal group UTA0576 conducting sophisticated post-exploitation activities including Active Directory metadata theft, Kerberos attacks, and BitLocker recovery key harvesting while evading detection through selective log tampering. This incident highlights the accelerating trend of VPN infrastructure targeting by cybercriminals who are increasingly focusing on legitimate remote access solutions as primary attack vectors, exploiting the expanded attack surface created by hybrid work environments and the critical trust boundaries that VPN appliances represent in modern enterprise networks.
Kill Chain
