Even when technology vendors discover vulnerabilities before threat actors do, they can still fall victim to zero-day attacks.
That's the unfortunate situation Ivanti found itself in this week, as attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure (ICS) products: a high-severity authentication bypass vulnerability and the follow-on ability for unauthenticated remote code execution (RCE) in the SSL-VPN and remote-access gateway. The cybersecurity vendor yesterday disclosed both flaws collectively as CVE-2026-104935.
"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure," Ivanti said in its advisory.
But the situation is more complicated than your typical zero-day scenario. According to the advisory, Ivanti actually "discovered a portion of this vulnerability" in July through the vendor's product security program, and patched it with the ICS version 25.1.3.0 release. "We had been working to backport the fix to the remaining supported versions when exploitation occurred," Ivanti said.
Volexity researchers discovered that a threat actor, tracked as UTA0576, was using a zero-day exploit chain earlier this month that included CVE-2026-104935. The chain compromised ICS appliances that were fully patched at the time.