14 OCT 2026 — Ivanti has patched an actively exploited flaw in its Connect Secure VPN gateway, but the attack that exposed it used three weaknesses, and one of them is still open. Volexity, the security firm that found the intrusion, says an unknown group was breaking into fully patched appliances from 3 October and then running commands as root.
Ivanti's own advisory adds an awkward detail. The company says it had already found part of this vulnerability itself and fixed it in a July release, and was still moving that fix to its older supported versions when the attacks started.
What Ivanti fixed on 13 October
The flaw is tracked as CVE-2026-104935, an authentication bypass that lets a remote attacker with no account run commands on the gateway. Ivanti rates it 8.6, which is high rather than critical. The security advisory lists three affected lines: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The fixed builds are 25.1.1.2, released on 5 October, 22.8R2.5, released on 12 October, and the 25.1.3 releases. Version 22.7R2.14 and older are not affected.
Ivanti says it is aware of exploitation affecting "a limited number of customers". The US Cybersecurity and Infrastructure Security Agency added the CVE to its catalogue of exploited vulnerabilities the same day, according to the NVD record.
How the chain worked
Volexity's write-up describes three steps. A request to the public login page carried a header naming a different, protected script, and the appliance routed the request to that script without checking the user was logged in. A file upload handler then wrote the attacker's file to disk before checking whether it was a valid archive, and the attacker raced to run it in the moment before it was deleted. Finally, a privilege escalation abused a background service that runs maintenance tasks as root, by quietly changing which executable one of those tasks launches.
Ivanti tracks the first two steps together as CVE-2026-104935. The third, the privilege escalation, has no fix yet. Volexity says Ivanti will include one "in a future release in the coming weeks".
Why the usual check may miss it
Volexity tracks the group as UTA0576. It installed no malware and no web shell, so it had no lasting foothold to find. For each command it ran, it executed the whole exploit chain again and read the result in the HTTP response. It patched an Ivanti library in memory and restored it, and it removed its entries from the appliance's debug and audit logs.
That matters because Ivanti tells customers to run its Integrity Checker Tool regularly. Because the chain patches code only in memory and puts back the configuration it alters, Volexity says the tool "does not detect any modifications". If you suspect a compromise, Volexity recommends network and memory forensics, a look in the appliance's /tmp directory for leftover scripts, and a watch for large numbers of requests to the login script where the URL and the routing header do not match.
What the attacker went after
Once inside, UTA0576 was after credentials. Volexity lists domain credentials stored on the gateway, Active Directory data, Microsoft LAPS-managed local administrator passwords and BitLocker recovery keys. The group also ran password spraying and captured directory traffic in packet form, a trick Volexity says another group, UTA0533, recently used against SonicWall SMA gateways.
Volexity also says, with medium confidence, that the group uses large language models to write its exploits and its follow-up scripts, citing the highly specific code and the complexity of the chain.
A fix that was already half written
The advisory's FAQ is unusually candid. Ivanti says it "initially discovered a portion of this vulnerability as part of our product security program" and patched it in 25.1.3.0 in July. "We had been working to backport the fix to the remaining supported versions when exploitation occurred," the company says. Upgrading to 25.1.3 is not quick: the line needs new hardware or freshly built virtual appliances. Customers who stayed on 22.8, a branch Ivanti itself calls "a temporary bridge", got their fix only on 12 October.
If you run one of these gateways, move to a fixed build now. Treat a clean Integrity Checker result as weak evidence, and if you see the request pattern Volexity describes, rotate any credentials the gateway could reach. Severity scores alone would have put this below "critical", a reminder of why a CVSS number is not a patch queue. To see how the 8.6 is built, rerun the vector in our CVSS 3.1 calculator, a RECATOOLS tool.
View author profile → · Editorial policy
