Vulnerabilities
Ivanti Connect Secure VPN flaw let attackers run code and steal credentials
A newly discovered flaw in Ivanti Connect Secure VPNs let attackers run code without logging in, steal credentials and access sensitive data. CISA urges urgent patching.
Ross Grant3 min read
The short version
A serious flaw in Ivanti Connect Secure VPNs lets attackers break in without a password and run code on the device. This can lead to stolen credentials and access to sensitive company data. Organisations using these VPNs should patch immediately.
By the numbers
- 3zero-day vulnerabilities chained in the attackSecurityWeek
- 13 October 2026date CISA confirmed active exploitationCISA
- 4Ivanti Connect Secure versions patchedSecurityWeek
What happened?
CISA confirmed on 13 October 2026 that attackers are exploiting a zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure VPNs. The flaw lets attackers bypass authentication and run commands remotely. Ivanti has released patches and CISA urges immediate updates.
What is the Ivanti Connect Secure vulnerability?
On 13 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a new Ivanti Connect Secure VPN vulnerability (CVE-2026-104935) to its Known Exploited Vulnerabilities (KEV) catalogue. This means there is confirmed evidence that attackers are actively exploiting this flaw in the wild, not just in lab conditions. Ivanti Connect Secure is a widely used VPN appliance for secure remote access to corporate networks.
How attackers exploited the flaw
According to CISA and security firm Volexity, the vulnerability is an authentication bypass. This means attackers can access the VPN without needing a valid username or password. Once in, they can execute commands on the device remotely, with full system privileges. Volexity found that attackers chained this flaw with others to gain root-level (highest) access, even on fully patched devices. The attackers focused on stealing credentials, exfiltrating limited Active Directory data, and preparing for possible further attacks inside the network. They used custom tools to search for sensitive passwords and recovery keys, and attempted to extract credentials from network traffic and logs. No persistent backdoor or web shell was found, but the attackers tampered with logs and configuration data.
Who is affected and what should you do?
The vulnerability affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Ivanti has released patches in versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. CISA urges all organisations using these VPNs to update immediately. If patching is not possible, organisations should consider taking the device offline. For those concerned about compromise, CISA recommends conducting network and memory forensics. Ivanti’s Integrity Checker Tool may not detect this attack, because the malicious commands run only in memory and do not leave traces on disk.
What else do we know about the attackers?
Volexity attributes the attack to a group it tracks as UTA0576. The group used at least three zero-day vulnerabilities in combination. Volexity believes the attackers’ main goal was credential theft and preparation for wider network compromise. There is some evidence they used large language models (LLMs) to help develop their exploits and post-exploitation tools. Volexity assesses with low confidence that the group is criminal rather than state-backed, but this is not certain.
What happens next?
Ivanti plans to patch a related privilege escalation flaw in the coming weeks. Organisations should continue to monitor for updates and follow CISA and Ivanti guidance. Federal agencies in the US are required to patch this flaw under CISA’s Binding Operational Directive 26-04, but CISA recommends all organisations prioritise remediation of vulnerabilities listed in the KEV catalogue.
Practical advice for defenders
- Patch affected Ivanti Connect Secure devices immediately.
- If you suspect compromise, conduct memory and network forensics rather than relying on standard integrity checks.
- Review logs for unusual activity, but be aware that attackers may have tampered with them.
- Change credentials that may have been exposed.
- Monitor for further updates from Ivanti and CISA.
For more, see CISA's alert (opens in a new tab) and SecurityWeek's report (opens in a new tab).
Claimed vs confirmed
- Confirmed
Attackers used three zero-day vulnerabilities to gain root access to fully patched Ivanti VPNs.
Volexity and SecurityWeek report attackers chained three zero-days, including CVE-2026-104935, for root access.
- Confirmed
Attackers focused on credential theft and data exfiltration.
Volexity found attackers stole domain credentials and Active Directory metadata.
- Unconfirmed
Attackers used large language models (LLMs) for exploit development.
Volexity assesses with medium confidence that LLMs were used, but this is not fully confirmed.
The impact
- Money
- No direct loss figures are given, but under US law, breached companies may face costs for incident response and possible regulatory fines. Federal agencies must patch under CISA's BOD 26-04.
- Reputation
- Ivanti faces scrutiny as attackers gained access even on fully patched devices. Trust in the product may be affected until all flaws are fixed.
- Customers
- Customers using affected Ivanti Connect Secure VPNs are at risk of credential theft and data exposure. They should patch immediately and consider changing passwords.
Why it matters
Ivanti Connect Secure VPNs are widely used for remote access. A flaw that lets attackers in without a password puts sensitive data and credentials at risk. If exploited, attackers could move deeper into a company's network. Patching is urgent to protect users and data.
How does it work?
The vulnerability allows an attacker to bypass authentication on Ivanti Connect Secure VPN appliances. This means they can access the device without a valid login and execute commands remotely, potentially with full system privileges. Attackers can then steal credentials, exfiltrate data, and prepare for further attacks.
Key points
- Ivanti Connect Secure VPNs have a critical authentication bypass flaw (CVE-2026-104935).
- Attackers can run code remotely and steal credentials without logging in.
- CISA and Ivanti urge immediate patching; standard tools may not detect compromise.
- Attackers focused on credential theft and preparing for wider network attacks.
- Memory and network forensics are needed to detect signs of exploitation.
Sources
CISA
Government
- CISA adds Microsoft Windows flaw CVE-2026-96951 to Known Exploited Vulnerabilities: Microsoft Windows Command Injection Vulnerability (opens in a new tab)
cisa.gov
- CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (opens in a new tab)
cisa.gov
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (opens in a new tab)
cisa.gov
- CISA adds Microsoft Windows flaw CVE-2026-96951 to Known Exploited Vulnerabilities: Microsoft Windows Command Injection Vulnerability (opens in a new tab)
SecurityWeek
Reference
