CISA adds actively exploited Ivanti flaws to known vulnerabilities catalog

The Cybersecurity and Infrastructure Security Agency added two security flaws impacting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog, The Hacker News and Security Affairs reported. The action followed active exploitation in the wild where attackers chained three flaws to achieve unauthenticated root access. [1][6]

CyberSecurityNews, GBHackers News, and Cyber Press also reported that hackers actively exploited Ivanti Connect Secure zero-day vulnerabilities in the wild to gain root access. According to The Hacker News, the exploit chain was first documented earlier in the month by cybersecurity firm Volexity. The firm observed the zero-days weaponized alongside an authentication bypass vulnerability, tracked as CVE-2026-104935 with a CVSS score of 8.6, by an undocumented group named UTA. [1][2][3][4][5]

As FTMQ Security reported earlier, attackers chain three Ivanti zero-day flaws to execute arbitrary commands without an account. Ivanti previously released a fix for part of the exploit chain in its version 25.1.3.0 release, while CCB Belgium issued a warning urging organizations to patch immediately. [7][13]