Ivanti Connect Secure Zero-Day: Patch Your VPN, Then Check It Wasn’t Already Hit
If your company runs Ivanti Connect Secure for remote access, this one needs your attention today. On 13 October 2026, Ivanti released fixes for CVE-2026-104935, a flaw that lets an attacker run commands on the VPN appliance without logging in, according to Rapid7’s analysis. Attackers were already using it before the patch existed.
My day job sits close to network detection and response, and VPN boxes like this are exactly where I’d expect trouble to start. They sit at the edge of the network, face the internet, and hold the keys to everything behind them.
What happened
Volexity, the security firm that found the attack, says it began investigating suspicious activity at a customer on 5 October 2026. The root cause was an Ivanti Connect Secure appliance that was fully patched at the time, running version 22.8R2.4.
Volexity says an unknown group it tracks as UTA0576 had been exploiting the appliance since 3 October. The attackers chained three weaknesses together: an authentication bypass, a file-write bug that led to code execution, and a privilege escalation that gave them root. Ivanti tracks the first two under CVE-2026-104935.
The US cyber agency CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October, describing it as an authentication bypass that “allows a remote unauthenticated attacker to execute arbitrary commands.” CISA gave US federal agencies until 16 October to act and marked forensic triage as required. Rapid7 adds that the bug carries a CVSS score of 8.6 and that, according to Ivanti, exploitation affected “a limited number of customers.”
What the attackers went after
Once inside, the group went straight for credentials. Volexity lists what it saw:
- Domain credentials stored on the appliance, such as those used for LDAP
- Active Directory searches for LAPS local admin passwords and BitLocker recovery keys
- Parsing packet captures on the device to pull plaintext LDAP credentials
- Password spraying against Active Directory accounts
- Copying the appliance’s own configuration and authentication logs
Volexity assessed with high confidence that this was groundwork for moving deeper into the network. Because the intrusion was caught and disrupted, nobody knows what the final goal was.
Remote access tools keep turning up in these stories, and I wrote about another one in my post on the BeyondTrust Remote Support flaw.
Why “just patch it” is not enough this time
Two details make this harder than a normal patch day.
First, the privilege escalation step is still unfixed. Volexity says Ivanti will include that fix “in a future release in the coming weeks.” The 13 October patch blocks the way in, which breaks the chain, but one piece remains open.
Second, the attackers cleaned up after themselves. Volexity says they deleted entries from Ivanti’s debug log and the Linux audit log, left no web shell or backdoor, and changed code only in memory. As a result, Ivanti’s own Integrity Checker Tool did not detect the changes. A clean scan from that tool does not prove a clean device.
Volexity also says, with medium confidence, that the group likely used large language models to build the exploit and the scripts it ran afterwards. That fits a pattern I wrote about with CLOSEDQUORUM, where AI showed up on the attacker’s side of the table.
Which versions are affected
These come from Rapid7’s summary of Ivanti’s security advisory. Volexity’s report names the same affected lines (25.1.1, 25.1.2 and 22.8R2.4). Check the advisory itself before you upgrade:
- 25.1.1.1 and earlier: upgrade to 25.1.1.2
- 25.1.2.2 and earlier: upgrade to 25.1.3.0 or 25.1.3.1
- 22.8R2.4 and earlier: upgrade to 22.8R2.5
Rapid7 says Ivanti’s advisory confirms versions 22.7.x and below are not affected.
If your edge kit also includes email security, read my piece on the Cisco Secure Email Gateway zero-day too.
What to do today
- Patch now, outside your normal cycle. That is Rapid7’s recommendation, and I agree with it.
- Hunt for signs of earlier compromise. Volexity suggests watching for large numbers of requests to
/dana-na/auth/url_default/welcome.cgithat carry anX-DSCGI-PATHheader, and for mismatches between the URL path and that header. Check/tmp/on the appliance too. Volexity has published indicators on its GitHub page. - Look behind the VPN. If the device was exposed in early October, review LDAP and Active Directory activity from the appliance’s service account, and watch for lateral movement starting from the VPN.
- Rotate what it could see. If you find anything suspicious, reset the service account password the appliance uses for Active Directory, and treat stored LAPS passwords and BitLocker recovery keys as possibly exposed.
- Bring in forensics if in doubt. Volexity found this through memory and disk analysis, not the built-in checker.
Then put a reminder in your calendar for Ivanti’s next release, because the privilege escalation fix is still to come.
Leave a comment