A critical flaw in Ivanti Connect Secure appliances is now being actively exploited to break into corporate networks, steal credentials, and quietly harvest sensitive data. The Cybersecurity and Infrastructure Security Agency added the vulnerability, tracked as CVE-2026-104935, to its Known Exploited Vulnerabilities catalog on October 13, 2026, and is pressing administrators to patch immediately. The flaw affects widely deployed versions of the remote-access software, including 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
How the Attack Works
Connect Secure appliances sit at the edge of enterprise networks, brokering remote access for employees. That position makes them an especially valuable target: compromise one, and an attacker gains a foothold deep inside an organization's infrastructure. According to research from Volexity, a threat actor identified as UTA0576 began exploiting the vulnerability on October 3, chaining together an authentication bypass, a file-upload weakness that enabled code execution, and a separate privilege-escalation bug. Combined, these flaws delivered root access - the highest level of control an attacker can obtain on the device.
Notably, the appliance investigators examined was fully patched at the time of compromise, underscoring that this was a genuine zero-day attack rather than one relying on unpatched, previously known issues.
What Attackers Did After Breaking In
Once inside, the intruders moved quickly to extract value from their access. Investigators observed the attacker collecting stored domain credentials, querying Active Directory, and searching for local administrator passwords and BitLocker recovery keys. They also conducted password spraying, mapped out connected networks, and attempted to recover credentials from intercepted traffic - a pattern consistent with efforts to expand access well beyond the initial appliance.
Perhaps most concerning is how the attackers operated without leaving typical traces. Investigators found no web shell or persistent backdoor. Instead, the threat actor repeatedly re-ran the exploit chain itself, retrieving command output embedded in HTTPS responses. They altered library code in memory, reverted configuration changes, and deleted selected log entries to cover their tracks. CISA has warned that Ivanti's own Integrity Checker Tool may fail to detect this activity, since the malicious commands execute in memory rather than writing persistent files to disk. That gap makes network traffic analysis and memory forensics essential for any organization trying to determine whether its appliance was breached.
Patching Is Only the First Step
Ivanti released fixes for the authentication bypass and remote code execution components on October 13, the same day CISA added the flaw to its catalog. A fix for the separate privilege-escalation vulnerability was still in development at the time of the research, but CISA has advised administrators not to wait for that additional patch before applying the available update.
Because upgrade paths differ significantly between hardware, cloud, and virtual deployments, CISA has pointed administrators to Ivanti's migration guide rather than a single generic update process. Organizations should back up their appliance configuration before beginning recovery. If compromise is suspected, CISA recommends a full factory reset and clean installation of the latest version; cloud and virtual appliances should be rebuilt entirely and upgraded before any saved configuration is restored.
Patching the software does not undo what may already have been stolen. CISA's guidance calls for a broader credential reset, including:
- Resetting domain, administrator, and local account passwords
- Revoking and reissuing certificates stored on the appliance
- Rotating stored API keys and license server credentials
Organizations still running the 22.8 branch face an added deadline: that version line reaches end-of-life on January 31, 2027, meaning migration planning should begin well before the patch cycle for this vulnerability concludes. Given the pattern of repeated zero-day exploitation against edge devices like Connect Secure in recent years, security teams should treat these appliances as high-value targets requiring continuous monitoring, not just periodic patching.