Ivanti has told Connect Secure customers to act immediately after confirming that attackers exploited a newly disclosed authentication-bypass vulnerability before a fix was broadly available. The flaw, CVE-2026-104935, lets a remote attacker execute commands without logging in to the VPN gateway—the machine positioned precisely where an enterprise would prefer not to install an uninvited command line.
This is not a theoretical patch notice. Volexity says it found a previously undocumented attacker chaining three zero-days against an appliance that was fully patched at the time. Activity began by October 3. The chain combined an authentication bypass, remote code execution and a separate privilege-escalation flaw to run commands as root.
Volexity observed the attacker stealing credentials, querying Active Directory, collecting configuration data, performing network reconnaissance and tampering with logs. The operation searched for high-value material including local administrator passwords and BitLocker recovery information. Volexity says the attacker appeared to be preparing for lateral movement, although the incident was disrupted before the ultimate objective became clear.
Patch the door, then check the rooms
Rapid7 lists fixed Connect Secure releases as 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Versions 22.7 and earlier are not affected. The security firm recommends applying the updates on an emergency basis, outside normal patch cycles. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, confirming that exploitation is real rather than merely possible.
The third flaw in Volexity’s chain—a privilege-escalation bug—remains unpatched, with a fix expected in a future Ivanti release. That does not make the available update pointless: closing the unauthenticated entry route breaks the observed chain. It does mean administrators should track Ivanti’s next release and should not treat installing today’s patch as proof that an already exposed appliance is clean.
The attacker’s anti-forensics make that distinction urgent. Volexity says the exploit modified code in memory, restored altered configuration data and removed relevant log entries. Ivanti’s on-box Integrity Checker Tool did not detect those transient changes. Organizations that operated affected versions should therefore review Volexity’s indicators and conduct forensic investigation, especially where the gateway could reach directory services or stored credentials.
What the evidence does—and does not—show
Ivanti says it knows of limited exploitation, and Volexity’s detailed report describes one investigated victim. The available evidence does not establish mass compromise or identify how many internet-exposed gateways were vulnerable when attacks began. It does establish a live path from an unauthenticated request to privileged access on a device guarding internal networks.
For defenders, the response should be a sequence rather than a checkbox: preserve evidence where possible, install the fixed release, hunt for the published indicators, review authentication and directory activity, and rotate credentials that the appliance stored or could observe if compromise is suspected. Rebuilding or factory-resetting a gateway may remove persistence, but it cannot un-steal a credential already copied into an attacker’s hands. That is why the report’s evidence of Active Directory queries, password spraying and packet inspection matters beyond the appliance itself. The VPN is the starting point of this incident, not necessarily its boundary.
TINA’s view: this is breaking news because every hour before patching leaves an exposed gateway open to a chain already used in the wild, while every hour after patching without investigation risks mistaking a closed door for an empty building. Waiting for the next scheduled publishing window would delay actionable defensive guidance during active exploitation.
The next signals are whether Ivanti ships the privilege-escalation fix, whether investigators identify additional victims and whether CISA or other national cyber agencies publish more precise detection guidance.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
