Attackers Are Breaking Into Fully Patched Ivanti VPNs: What Connect Secure Customers Are Asking
An attacker chained three previously unknown flaws in Ivanti Connect Secure to take over VPN appliances without logging in. Two are fixed, one is not, and CISA wants federal agencies patched by Friday. Here are the answers owners need.
If your staff connect to the office through an Ivanti Connect Secure VPN, this is the week to check on it. An attacker has been breaking into these appliances without a password, and the first known victim was fully up to date at the time. Below are the questions we expect to hear, answered from what has been published so far.
Our answers draw on The Hacker News’ summary of Volexity’s findings, its follow-up on CISA’s alert and honeypot activity, and reporting from The Record.
What happened?
Security firm Volexity found that an attacker had chained three zero-day flaws in Ivanti Connect Secure, the remote-access VPN appliance, to run commands as the all-powerful root user without logging in. Volexity says exploitation began on October 3, 2026, against a customer appliance running version 22.8R2.4, which was fully patched at the time. Volexity reported the flaws to Ivanti, and Ivanti says it is aware of “limited exploitation in the wild.”
Which flaws are involved?
An authentication bypass and a remote code execution flaw, tracked together as CVE-2026-104935 and rated 8.6 out of 10, let an attacker run code on the appliance. A third flaw, a privilege escalation, then raises that access to root. Ivanti fixed the first two on Tuesday, October 13. The fix for the third is expected “in a future release in the coming weeks,” according to Volexity.
Which versions should we be on?
- Affected: Connect Secure before version 25.1.3.0, according to the CVE record Ivanti filed.
- Listed as not affected: 22.8R2.5, 25.1.3.0 and 25.1.3.1, as well as 22.7R2.14 and earlier.
- Plan ahead: CISA notes that the 22.8 line reaches end of life on January 31, 2027.
Ivanti told customers on affected versions to “act immediately.” Its own security advisory has the full version details.
How urgent is it?
Very. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Friday, October 16, to apply the fixes. Previdian, which runs decoy sensors, says it logged 105 exploitation attempts from 50 IP addresses as of October 14. Its CEO, Ryan Dewhurst, said the attempts so far mostly test whether code execution works, but that “full weaponized exploitation is likely to follow in the coming hours and days.”
What did the attacker do once inside?
In the incident Volexity investigated, the attacker stole credentials stored on the appliance, including LDAP domain credentials, searched Active Directory for administrator passwords and BitLocker recovery keys, and ran password-spraying attacks against company accounts. It also edited logs to cover its tracks. No backdoor or web shell was left behind; the attacker simply re-ran the whole exploit chain for each command. Volexity assesses, with low confidence, that the group it calls UTA0576 is motivated by money rather than espionage.
Will Ivanti’s Integrity Checker Tool tell us if we were hit?
Not for this one, according to Volexity. The exploit changes code only in memory and puts back the configuration data it alters, so the checker misses it. Both CISA and Volexity say confirming a compromise takes network and memory forensics. Signs from the one known incident include large numbers of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that does not match the URL path.
What if we find signs of compromise?
CISA’s steps: back up the appliance configuration, factory reset it (or rebuild a cloud or virtual instance) and upgrade to the latest version, restore the configuration, then reset passwords for all domain, administrator and local accounts and revoke and reissue stored certificates, API keys and license server credentials. Neither Ivanti nor Volexity has named a temporary workaround for anyone who cannot upgrade yet.
What this means for your company
A VPN appliance sits at the front door of your network and usually holds the keys to everything behind it. Practical steps for this week:
- Confirm whether you run Connect Secure. Ask your IT team or provider, and check for older or secondary appliances too.
- Upgrade now, and watch for the third fix. Move to an unaffected version and put a reminder in place for the privilege escalation patch due in the coming weeks.
- Assume credentials on the appliance may be exposed. If there is any doubt, follow CISA’s reset steps and reset the passwords of accounts the VPN can reach.
- Back up the VPN with stronger sign-in. Phishing-resistant multi-factor authentication and alerts on password spraying make stolen credentials less useful.
Need help patching and checking your remote-access appliances? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
