Vulnerabilities

Ivanti Connect Secure zero-day exploited, root flaw still unpatched

Ivanti patches exploited Connect Secure zero-day CVE-2026-104935; Volexity says the chain evades the Integrity Checker and a root bug awaits a fix.

Warning graphic for the Ivanti Connect Secure VPN zero-day CVE-2026-104935

Ivanti has patched an actively exploited zero-day in its Connect Secure VPN gateway that lets attackers in without credentials. A second flaw in the same attack chain, which grants root access, is still awaiting a fix.

What happened

On Tuesday 13 October 2026 Ivanti disclosed CVE-2026-104935, an authentication bypass in Ivanti Connect Secure (ICS), the remote access appliance formerly sold as Pulse Connect Secure. The company said it was aware of “limited exploitation in the wild”, that it was working directly with the affected organisations, and that anyone on an impacted version should act immediately.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue the same day, describing it as an authentication bypass by spoofing (CWE-290) through which an attacker with no credentials can run commands remotely. US federal agencies have until 16 October to remediate, a three-day deadline that tells you how CISA rates the risk.

Volexity, the incident response firm that found the bug and reported it to Ivanti, published a detailed write-up on the same day. It describes a previously unknown actor, tracked as UTA0576, exploiting the flaw since at least 3 October against an appliance that was fully patched at the time. Volexity began investigating suspicious activity at a monitoring customer on 5 October and traced the root cause to the VPN gateway.

Vulnerable builds run up to and including 22.8R2.4, 25.1.2.2 and 25.1.1.1. Ivanti’s CVE record, now on NVD, scores the issue CVSS 8.6 (High), lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as fixed, and says 22.7R2.14 and earlier are not affected. SecurityOnline also reports a 25.1.1.2 fix for 25.1.1.1 on ISA6000 and ISA8000 appliances, which the CVE record does not list.

The technical picture

What makes this incident stand out is not one bug but the chain. Volexity says UTA0576 combined three weaknesses: an authentication bypass in how the appliance routes requests to its CGI handlers, a file upload flaw that briefly leaves attacker-supplied content on disk before validation, and a privilege escalation in a root-level maintenance service. The first two are tracked together as CVE-2026-104935 and are fixed in Tuesday’s releases. The privilege escalation is not. Ivanti is working on it and Volexity expects a fix “in the coming weeks”.

The attacker’s tradecraft was notably disciplined. Volexity found no web shell, no implant and no separate command-and-control channel. Instead, the actor re-ran the whole exploit chain for every command, passing instructions and results inside ordinary-looking HTTPS requests. Changes to Ivanti’s libraries were made in memory only and then reversed, and entries were stripped from the appliance’s debug and Linux audit logs. The result, in Volexity’s words, is that Ivanti’s Integrity Checker Tool “does not detect any modifications”. Only memory and disk forensics revealed what had happened.

Once inside, the actor went straight for identity. Volexity documents theft of LDAP credentials stored on the gateway, Active Directory queries for LAPS local administrator passwords and BitLocker recovery keys, a custom Kerberos tool with Kerberoasting capability, password spraying, and a disguised packet capture tool harvesting plaintext credentials from traffic crossing the appliance. Volexity assesses with low confidence that the motive is criminal rather than espionage, and with medium confidence that the actor used large language models to help build its exploit and tooling.

Shadowserver currently tracks more than 5,500 internet-exposed ICS instances, BleepingComputer reports, although some of those will be honeypots or already patched.

Timeline of the Ivanti Connect Secure CVE-2026-104935 exploitation from 3 October to the pending privilege escalation fix

Why it matters for UK organisations

Ivanti Connect Secure is a familiar sight on UK perimeters, and a repeat offender. BleepingComputer notes that CISA has now listed 36 Ivanti vulnerabilities as exploited since November 2021, 12 of them used by ransomware gangs, and the NCSC warned of active Connect Secure exploitation in January 2025. Any UK organisation still running these gateways should assume they are a priority target.

Three features of this case raise the stakes. First, the device was fully patched when it was breached, so “we are up to date” offered no protection. Second, the standard vendor integrity check gives a false all-clear, which undermines any response that leans on that tool. Third, the post-exploitation activity targeted the keys to the Windows estate. Stolen LAPS passwords and BitLocker recovery keys turn a VPN compromise into a domain-wide problem, and under UK GDPR any resulting personal data exposure could trigger a 72-hour notification to the ICO.

Note too that the 22.7 and 22.8 branches reach end of life on 31 January 2027, according to SecurityOnline. Organisations patching today should also be planning the move to 25.x.

Expert view

In my experience, SSL VPN appliances are the single most reliable way into a mature network. They are internet-facing by design, they hold or broker domain credentials, and they are often treated as sealed boxes that the security team cannot monitor properly. When we test perimeter estates, the VPN concentrator is frequently the one device with no EDR, thin logging and a service account holding far more Active Directory rights than it needs.

This campaign exploits every one of those weaknesses. An attacker that leaves no files behind and cleans the logs as it goes is designed to defeat appliance-centric detection. The defensive answer has to come from around the box rather than inside it: network monitoring of what the gateway talks to, and identity telemetry showing what its service account does in the directory.

The unpatched privilege escalation matters, but I would not overstate it: without the authentication bypass, an attacker needs another route to code execution first. Patching closes the door UTA0576 actually used.

What to do now

  1. Patch today. Upgrade to 22.8R2.5, 25.1.1.2 or 25.1.3.x as applicable, following Ivanti’s advisory. Under Cyber Essentials security update management, a high-severity flaw with a fix must be patched within 14 days; with active exploitation, treat it as hours.
  2. Do not rely on the Integrity Checker. Volexity says it can miss this chain. If you see warning signs, such as lateral movement attempts originating from the appliance, preserve memory and disk images and bring in forensic support.
  3. Hunt in your logs. Volexity advises looking for high volumes of requests to the public login script carrying internal routing headers that do not match the requested URL, and checking the appliance’s temporary directories for unexpected files. Its indicators are published on GitHub.
  4. Rotate what the gateway can see. Reset the LDAP and Active Directory service account used by the appliance, and on any suspected compromise rotate LAPS passwords and review BitLocker recovery key access. This maps to Cyber Essentials user access control.
  5. Cut the service account’s rights. The VPN’s directory account should not be able to read LAPS or BitLocker attributes. Review its permissions now.
  6. Watch for the next patch. Track Ivanti’s advisories for the privilege escalation fix and schedule the move off 22.x before January 2027.

Bottom line

This is another Connect Secure zero-day, but a stealthier one than most: it hit fully patched devices, left almost nothing on disk and fooled the vendor’s own integrity tool. Patch now, investigate rather than assume, and lock down the directory access your VPN holds, because that is what the attacker was really after.

Sources

Related Posts