A newly disclosed vulnerability in Ivanti Connect Secure is already being used against live networks, according to a warning from the Cybersecurity and Infrastructure Security Agency. The flaw, tracked as CVE-2026-104935, allows an unauthenticated attacker to bypass login controls and execute commands remotely on affected VPN appliances - a category of device that sits at the front door of corporate networks and typically trusts little else more than it is trusted itself.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, confirming that exploitation predates public disclosure. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The agency has told organizations to apply Ivanti's patches immediately and consult its migration guidance for systems nearing end of support.
How the Attack Chain Works
The security firm Volexity traced the exploitation to October 3, after spotting suspicious activity five days later on an appliance running a version believed to be fully patched. The threat actor, tracked as UTA0576, chained together three separate weaknesses to gain full control. First, inconsistent routing of web requests let attackers reach restricted backend functionality through a login page that required no credentials at all. A flaw in file-upload handling then opened a narrow window in which a malicious script could run before the system deleted it - enough time to launch further stages that executed Python code directly in memory rather than writing it to disk.
To escalate from basic access to full administrative control, the attacker manipulated in-memory configuration tied to a privileged system service, redirecting a routine maintenance task into executing attacker-supplied code. Afterward, the payload quietly restored the original configuration and memory state, a step designed to erase the signs that anything had changed. This is a notable departure from older intrusion patterns, where attackers often left a web shell behind for continued access. Here, UTA0576 instead repeatedly re-ran the exploit itself whenever it needed to issue commands, receiving output back through ordinary encrypted web traffic.
What Was Stolen
Once inside, the attacker harvested credentials stored on the appliance, including domain account information used for LDAP authentication against Active Directory. Using one compromised service account, custom tooling then searched directory records for Local Administrator Password Solution entries, BitLocker recovery keys, and other password-bearing attributes - information that, in the wrong hands, can unlock far more of a network than the VPN appliance itself. Investigators also observed password-spraying attempts, inspection of authentication logs, internal DNS reconnaissance, and packet capture activity aimed at intercepting plaintext LDAP credentials, HTTP Basic Authentication data, and NTLM challenge-response hashes. Selected debug and audit log entries were deleted afterward, a move clearly intended to frustrate forensic review.
Why Standard Checks May Fail
CISA has cautioned that Ivanti's Integrity Checker Tool, a disk-based scanning utility, may not detect this exploitation because the malicious commands run entirely in memory and leave no persistent file artifacts. Organizations relying solely on that tool for reassurance could be given a false sense of security. Genuine investigation requires network traffic analysis and memory forensics, not just a disk scan.
For environments where compromise is suspected, CISA recommends backing up the appliance configuration, performing a factory reset, applying the update, and then restoring configuration data - while cloud and virtual deployments should be rebuilt from scratch and upgraded before anything is restored. Equally important, recovery must include resetting domain, administrator, and local account passwords, revoking and reissuing certificates, and replacing API keys and license server credentials. Patching the software alone does nothing to invalidate secrets an attacker has already copied. Organizations still running the 22.8 branch should also factor in its scheduled end of life on January 31, 2027, as they plan both remediation and longer-term migration of their remote access infrastructure.