Ivanti ICS Zero-Day Exploited by UTA0576

Ivanti disclosed CVE-2026-104935 on Tuesday after attackers UTA0576 exploited the flaw on Oct. 3. The threat actor used a zero-day chain to compromise patched ICS appliances, bypassing authentication and executing remote code. CISA added the vulnerability to its Known Exploited catalog, giving federal agencies until Oct. 16 to mitigate the high-severity risk.