Ivanti VPN attacks: a fully patched Connect Secure was broken into, and one flaw is still open

If your staff connect to work through an Ivanti Connect Secure VPN, the box that lets them in has been attacked even when it was fully up to date. Ivanti released fixes on 13 October, but one part of the attack chain is still open, so this needs more than a routine update.

In its October 2026 security update, Ivanti disclosed a vulnerability in “limited versions” of Connect Secure and said it was aware of limited exploitation in the wild. The flaw is tracked as CVE-2026-104935. The US cybersecurity agency CISA added it to its catalogue of known exploited vulnerabilities the same day, and the Canadian Centre for Cyber Security has encouraged administrators to review the advisories and apply the updates.

How the attack works

Security firm Volexity investigated a compromised Connect Secure appliance belonging to one of its customers. It says an attacker it calls UTA0576 began exploiting the device on 3 October, chaining three flaws:

1. An authentication bypass, so no login was needed.
2. A remote code execution flaw, letting the attacker run its own script on the device.
3. A privilege escalation flaw, which turned that into full root control.

The device was running version 22.8R2.4, fully patched at the time. Once inside, the attacker prepared to move into the wider network. Volexity reports theft of credentials stored on the device and captured from network traffic, collection of Active Directory data and password-spraying, as well as searches for local administrator passwords and BitLocker recovery keys.

The attacker also deleted log entries and changed the device only in memory. Ivanti’s Integrity Checker Tool did not detect this compromise, Volexity says.

What the fix covers, and what it doesn’t

The 13 October patches fix the first two flaws, both covered by CVE-2026-104935. Volexity says the privilege escalation flaw is not yet patched and Ivanti plans to fix it in a future release in the coming weeks.

Rapid7’s summary of Ivanti’s advisory lists the fixed versions as 22.8R2.5, 25.1.1.2, and 25.1.3.0 or 25.1.3.1, and says versions 22.7 and earlier are not affected. We couldn’t open Ivanti’s advisory directly, so have whoever manages the VPN confirm the right version for your branch there. Rapid7 recommends treating the update as an emergency rather than waiting for the next patch window.

Ivanti’s own advice is to upgrade as soon as possible, run the Integrity Checker Tool regularly, and back the fix with access controls, network monitoring and log review. Given what Volexity found, our reading is that a clean integrity check after patching is useful but not proof the device was never breached.

What to ask your IT provider

Most smaller organisations won’t manage the VPN themselves. Ask whoever does whether you run Ivanti Connect Secure, and for written answers to three questions: which version is running now, when the 13 October fix was installed, and what they did to check for compromise beyond the Integrity Checker.

Volexity recommends looking for unusual request patterns, files left in temporary folders and signs of the VPN being used to reach other systems, and network and memory forensics, because the Integrity Checker may not identify a compromise. Ask too how they will handle the remaining fix when Ivanti releases it. If they do find compromise, our recommendation, given the credential theft Volexity describes, is to treat passwords and keys reachable from the VPN as exposed and have them changed.

If anything suspicious turns up, report it through ReportCyber. Our earlier alert on NetScaler sign-in flaws uses the same provider questions, and the Security hub collects related guidance.

Checklist

• Find out whether you use Ivanti Connect Secure. Ask your IT provider which product staff use for remote VPN access.
• Get the running version in writing. Have the provider confirm it is 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1, or a later version Ivanti’s advisory lists as fixed.
• Ask for a compromise check, not just a patch. Ask what was checked beyond Ivanti’s Integrity Checker Tool, which missed the attack Volexity investigated.
• Plan for the second fix. Ask who will install Ivanti’s privilege escalation patch when it is released, and how quickly.
• Reset credentials if compromise is found. Have the provider change passwords and keys reachable from the VPN, including the local administrator passwords and BitLocker recovery keys the attacker searched for.
• Report anything suspicious. Use ReportCyber at cyber.gov.au if your provider finds signs of compromise.