Ivanti Connect Secure: zero-day CVE-2026-104935 exploited

On 13 October 2026 Ivanti released updates for Ivanti Connect Secure (ICS), the SSL VPN gateway many companies use for remote access, fixing CVE-2026-104935: an authentication bypass that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. The CVSS v3.1 score is 8.6 (high severity). Ivanti confirmed “limited” exploitation affecting a small number of customers and urges customers to act immediately.

The same day CISA added the vulnerability to its KEV catalog, with a Friday 16 October deadline for US federal agencies, and published an advisory aimed at all organisations. Alerts followed from NBSZ NKI (Hungary, 14 October) and SingCERT (Singapore, 20 October).

The attack chain

The flaw was discovered by Volexity, which began investigating suspicious activity on 5 October and traced it to a fully patched ICS appliance compromised since 3 October. Threat intelligence firm Defused observed the first signs of exploitation as early as 1 October.

According to Volexity, the attackers chained three vulnerabilities:

1. an authentication bypass;
2. remote code execution (RCE);
3. privilege escalation to root.

The first two are covered by CVE-2026-104935 and fixed by the 13 October updates. The third is a separate flaw and not yet fixed: Ivanti is aware of it and expects to release a fix “in the coming weeks”.

According to The Register, Ivanti had already fixed “a portion” of the vulnerability in July in 25.1.3.0, but attacks started before the backport to the other branches was complete; Dark Reading stresses that the July fix was only partial.

Who is behind it and what they did

Volexity attributes the attacks to a previously unknown group it tracks as UTA0576 and assesses, with low confidence, that its motivations are criminal rather than espionage. Some technical details:

• no malware and no web shell: the group re-exploited the vulnerability for every command, using only the tools already on the appliance;
• log tampering to cover its tracks, which allowed it to evade Ivanti’s Integrity Checker Tool (ICT);
• theft of Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys (a detail reported by BleepingComputer quoting Volexity), as well as data exfiltration and network reconnaissance.

According to Volexity (high confidence), the group was preparing lateral movement and a broader compromise, cut short when the attack was detected.

In MITRE ATT&CK terms: initial access via T1190 (Exploit Public-Facing Application), escalation via T1068 (Exploitation for Privilege Escalation), covering tracks via T1070 (Indicator Removal), followed by Credential Access (TA0006), Discovery (TA0007) and Exfiltration (TA0010).

Affected and fixed versions

Affected:

• 22.8R2.4 and earlier;
• 25.1.1.1 and earlier;
• 25.1.2.2 and earlier.

Fixed versions are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. According to the Hungarian alert, which reports Ivanti’s guidance, 22.7R2.14 and earlier are not affected; the 22.7 branch reaches end of support on 31 January 2027 and 22.8 is only meant as a stepping stone to 25.1, so plan the migration. If you cannot move to 25.1 right away, you can install 22.8R2.5.

Indicators and detection

Ivanti’s advisory contains no public indicators of compromise (IP addresses, domains, hashes) and refers to Volexity’s report. CISA warns that the ICT may not detect exploitation, because the commands run in memory: to determine whether an appliance was compromised you need network and memory forensics.

Shadowserver counts more than 5,600 Internet-exposed hosts with an ICS fingerprint, with no way of knowing how many are already patched or are honeypots. The Hacker News reports 105 exploitation attempts logged by honeypots.

Impact for European and Italian companies

SSL VPNs are the entry point for employees, suppliers and maintenance staff, and by definition they sit on the Internet. This case is delicate for two reasons: the privilege escalation is still open, and the attackers go after Active Directory credentials, which remain valid even after the appliance is updated.

For NIS2 entities, patching falls under vulnerability management with documented timelines; a confirmed compromise must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN, with an early warning within 24 hours for significant incidents). In healthcare, where the VPN often serves remote access for doctors and medical device suppliers, stolen domain credentials can open the way to clinical systems.

What to do now

1. Update every appliance, including all nodes of high-availability clusters, to the fixed version for your branch, then check version and integrity.
2. Run the ICT, but don’t rely on its result alone: look for anomalous authentications, configuration changes, unusual outbound connections and gaps in the logs.
3. Preserve evidence before acting and, if in doubt, have network and memory analysed.
4. If you find a compromise, follow CISA’s guidance: back up the configuration, perform a factory reset and upgrade (for cloud and virtual instances, rebuild them), restore the configuration, reset the passwords of all accounts (domain, administrator, local), revoke and reissue certificates, and change API keys and license server credentials.
5. Check Active Directory: reads of LAPS passwords and BitLocker keys, logons from the VPN’s internal address, new accounts or privileges.
6. Follow Ivanti’s advisory for the privilege escalation fix and install it as soon as it is released.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet and which have known vulnerabilities, so you immediately know whether a remote access gateway is reachable from outside. ARX Sentry collects firewall and network device logs in a central collector, outside the appliance: tampering with local logs does not erase what has already been sent. ARX Sentry’s identity pages highlight privileged logons, bursts of attempts and account changes, which help recognise the use of stolen credentials.

Last updated: 20 October 2026