Ivanti Connect Secure Zero-Day Under Active Attack: Patch Now and Check for Compromise

On October 13, Ivanti confirmed active exploitation of a vulnerability in Connect Secure and urged customers to update immediately. The same day, Volexity published an account of an attack on a VPN gateway that had every available patch installed at the time of the breach. What’s new is the public disclosure of how the device was taken over, along with a fix for part of the exploited vulnerability chain.

What was disclosed

CVE-2026-104935 lets an unauthenticated attacker run commands on a vulnerable device. According to Volexity, the attackers chained an authentication bypass and code execution with a separate privilege escalation flaw. This gave them root-level access to the system.

The researchers observed activity by a group tracked as UTA0576 starting on October 3. They documented credential theft, network reconnaissance, and searches of Active Directory for local administrator passwords and BitLocker recovery keys. The ultimate goal of the operation has not been determined.

A key caveat: at the time the report was published, a fix for the separate privilege escalation flaw was still in development. That is no reason to hold off on the updates that are available. They remove earlier links in the attack chain described above.

Who is at risk

The threat affects organizations that use Ivanti Connect Secure for remote access. Administrators should check their device version and platform against the vendor’s advisory, then apply the patched release specified for that configuration.

In the case Volexity investigated, the attackers deleted log entries and ran commands without leaving a persistent access mechanism behind. Volexity warns that the Integrity Checker Tool may not detect this kind of compromise. A clean file integrity check is therefore not enough to rule out a breach.

What to do now

• Identify every Connect Secure gateway, including standby devices, and apply the correct update urgently, following Ivanti’s instructions.
• Run the integrity checks the vendor recommends, and back them up with analysis of network traffic and logs from other systems.
• Look for unusual connections from the gateway into the internal network and for activity on accounts used for directory integration.
• If you suspect a compromise, preserve evidence for analysis, including device memory, and activate your incident response procedure. Assess whether exposed passwords and other secrets need to be rotated.

SecurHUB’s take

A VPN gateway is a critical control point for access to the corporate network, so updating it should go hand in hand with assessing the possible impact of an earlier breach. Incident response helps establish the scope of a compromise and organize remediation based on the evidence collected.

Sources: Ivanti, Volexity, BleepingComputer