Ivanti warned on Tuesday that CVE-2026-104935, an authentication bypass in Connect Secure rated 8.6, is under active attack. On its own that would be bad enough. The company that found it in the wild, Volexity, says the group it tracks as UTA0576 isn't using the bypass alone — it's chaining it with a remote-code-execution bug and a privilege-escalation bug to land unauthenticated root on appliances that were fully patched going in. The last link in that chain, the privilege escalation, still has no fix; Ivanti says one is coming in a later release. The detection story is the part that should worry you. The actor tampered with logs, so the vendor's own Integrity Checker Tool can miss it, and patching closes the front door without evicting anyone already inside. Fixed builds are 25.1.1.2, 25.1.3.0/25.1.3.1, and 22.8R2.5; 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are exposed. CISA has added the bypass to its exploited-vulnerabilities catalog. Upgrade, then go hunting — don't assume a clean appliance.