An attacker used three previously unknown flaws in Ivanti Connect Secure, a widely deployed VPN appliance, to execute commands with full administrative privileges without needing to log in, security firm Volexity reported on October 13. Ivanti has shipped patches for two of the vulnerabilities and urged customers running affected versions to "act immediately." A remedy for the third flaw is still forthcoming, according to Volexity.
Volexity discovered the attack on one client's appliance, which was fully updated at the time and operating version 22.8R2.4. The attacker, whom Volexity designates as UTA0576, started exploiting the device on October 3. Ivanti stated on October 13 that it knows of "limited exploitation in the wild." The opening two flaws consist of an authentication bypass paired with a remote code execution vulnerability, catalogued jointly as CVE-2026-104935. Combined, they allow an attacker to run code under the appliance's cgi-server user account, while the third flaw, a privilege escalation issue, elevates that access to root, Volexity said. The CVE filing Ivanti submitted indicates that Connect Secure versions "before version 25.1.3.0" are vulnerable, while version 22.7R2.14 "or prior" is not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are listed as unaffected. The release documentation for 25.1.3.0 is dated July 2026, meaning customers already running that version fall outside the vulnerable range. Ivanti is developing a patch for the privilege escalation flaw, which will arrive "in a future release in the coming weeks," Volexity said.
According to Volexity, Ivanti's Integrity Checker Tool fails to detect this exploit chain because the attack modifies library code solely in memory and reverts any configuration changes it makes. The attacker also employed techniques to evade detection by the tool. Verifying a breach requires forensic examination, including network and memory analysis, Volexity said. In the single incident Volexity investigated, the attacker extracted saved credentials, including LDAP domain credentials, queried Active Directory for passwords, and conducted password-spraying attacks against accounts. No backdoor or web shell was installed; instead, the attacker re-executed the complete exploit sequence for each command. Neither Volexity's report nor Ivanti's advisory identifies a temporary mitigation for customers unable to upgrade immediately, nor do they clarify whether upgrading eliminates access an attacker has already established.
Ivanti assigns CVE-2026-104935 a severity score of 8.6 out of 10 on the CVSS scale. In its own CVE record entry, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) designates exploitation as "active" and the technical impact as "total." Volexity assessed with low confidence that UTA0576's objective is criminal rather than espionage. Neither organization disclosed the number of customers targeted. The same Ivanti advisory addresses patches for two additional products, Xtraction and Neurons Patch for Intune, which Ivanti said have not been exploited. Each contains a flaw Ivanti rates 9.9 out of 10: CVE-2026-106042 in Xtraction before version 2026.4, and CVE-2026-109412 in Neurons Patch for Intune. Organizations running Connect Secure should upgrade to the patched versions and run the Integrity Checker Tool regularly, though they should understand its limitations in catching memory-only exploits. The absence of workarounds and the active exploitation status make swift patching the only clear defense until the third fix arrives. For enterprises weighing the operational cost of emergency patches against the risk of lateral movement from a compromised VPN gateway, this incident illustrates how credential theft through appliance compromise can cascade into domain-wide exposure.