A newly disclosed vulnerability in Ivanti Connect Secure is already being exploited in the wild, according to the Cybersecurity and Infrastructure Security Agency, which has added the flaw to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-104935, the authentication bypass allows unauthenticated attackers to execute commands remotely on affected VPN appliances, exposing both the devices themselves and the identity systems they connect to. CISA added the entry on October 13, 2026, and is urging immediate patching.
A Sophisticated Chain of Exploitation
The security firm Volexity first spotted suspicious activity on October 5, on an appliance running what was then considered the fully patched 22.8R2.4 release. Subsequent analysis traced the actual exploitation back to October 3, and attributed it to a threat actor Volexity designates UTA0576. The intrusion did not rely on a single flaw. Instead, attackers chained the authentication bypass with remote code execution and a separate, still-unpatched privilege escalation vulnerability that Ivanti and Volexity plan to address independently.
The technical mechanics reveal a carefully engineered attack. Inconsistent request routing allowed attackers to reach protected administrative functionality through a login endpoint that required no credentials at all. A flaw in file-upload handling then opened a narrow window in which an uploaded script could execute before being deleted, after which later stages ran Python code entirely in memory. To escalate to root privileges, the attacker manipulated in-memory configuration tied to the privileged dsinvoked service, hijacking a routine maintenance task to run malicious code. The payload then quietly restored the original configuration and memory state, erasing much of the evidence a defender might otherwise find.
Credential Theft at the Core of the Campaign
Rather than simply gaining a foothold, UTA0576 used its access to harvest credentials stored on the appliance, including domain credentials tied to LDAP authentication. With a compromised Active Directory service account in hand, the attackers deployed custom tooling to search directory data for Local Administrator Password Solution passwords, BitLocker recovery keys, and other password-bearing attributes - information that, once exposed, can unlock far more of an organization's infrastructure than the VPN appliance alone.
The group also conducted password spraying, inspected authentication logs, mapped internal DNS, and collected configuration data from the appliance itself. Packet capture analysis targeted plaintext LDAP credentials, HTTP Basic Authentication data, and NTLM challenge-response hashes - the kind of material that enables lateral movement well beyond the initial point of entry. Notably, the actor avoided installing a persistent web shell, instead repeatedly re-invoking the exploit chain and retrieving command output through ordinary HTTPS responses, while selectively deleting debug and Linux audit log entries to frustrate investigators.
Why Standard Detection Tools Fall Short
CISA has specifically cautioned that Ivanti's Integrity Checker Tool, which organizations commonly rely on to verify appliance integrity, may fail to detect this activity because the attacker's commands execute in memory rather than on disk. That distinction matters enormously for incident response: organizations suspecting compromise need network and memory forensics, not disk-based checks alone, to determine whether they have been breached.
Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. For confirmed or suspected compromise, CISA's recommended recovery path is demanding by design: back up configuration, perform a factory reset, upgrade, and only then restore configuration - with cloud and virtual deployments rebuilt from scratch rather than reset in place. Recovery also requires resetting domain, administrator, and local account passwords, revoking and reissuing certificates, and replacing API keys and license server credentials, since a software patch alone cannot invalidate secrets an attacker has already stolen.
Organizations still running the 22.8 branch face an added deadline: that version reaches end of life on January 31, 2027, making migration planning as urgent as the immediate patching response.
