Ivanti: zero-day chain impacts VPN despite updates

Ivanti disclosed a zero-day vulnerability in Connect Secure, its corporate VPN gateway, which has already been exploited by attackers prior to any fix being available. On the same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included the vulnerability, listed as CVE-2026-104935, in its catalog of actively exploited vulnerabilities, giving federal civilian agencies until October 16 to remediate. This provides a three-day window.

Three flaws, one unfixed

Incident response firm Volexity, which published a technical analysis on the same day, describes a chain of three defects. The first two, an authentication bypass and remote code execution, collectively grouped under CVE-2026-104935, allow an unauthenticated attacker to execute commands on the device using the web server user. The third flaw, a privilege escalation, elevates this access to root. According to Volexity, the group it tracks as UTA0576 has been exploiting this chain since at least October 3 against devices running version 22.8R2.4, the most recent version available at that time.

Ivanti has patched the first two defects. The privilege escalation remains unaddressed: according to Volexity, a fix will be "in a future release in the coming weeks." In practice, a company that implemented all the updates provided by the vendor by the beginning of the month was exposed to an attacker capable of taking full control of the device without a password. Rapid7 advised applying the update outside of the normal maintenance cycle.

Why the equipment matters

A VPN concentrator sits at the edge of the network and authenticates every employee, contractor, and vendor accessing internal systems. Compromising it gives the attacker a vantage point over credentials and sessions across the organization, and investigations can be difficult because these devices rarely run the detection agent installed on servers and workstations.

Connect Secure has a history. In January 2024, two linked vulnerabilities in the same product, CVE-2023-46805 and CVE-2024-21887, were exploited by a China-linked group tracked as UNC5221. CISA responded with emergency directive 24-01, and in a measure that industry media described as unprecedented, ordered federal agencies to disconnect all instances of the product within 48 hours, with factory reinstallation before reconnecting. The directive also stated to treat domain accounts associated with the devices as compromised.

Volexity did not assign UTA0576 to any particular country, and neither it nor Ivanti disclosed how many customers were attacked. This text does not make that attribution.

Where the risk spreads

In the U.S., the October 16 deadline applies only to the federal government, but CISA's list serves as a reference point for priority for banks, healthcare providers, and government contractors, who often use it in contracts and audits.

In Australia, industry media echoed the alert with recommendations for immediate remediation. The country experienced the 2024 incident closely: the Australian Cyber Security Centre published a joint advisory with CISA showing how attackers deceived Ivanti's integrity checking tool.

The case also reaches the outsourcing chain. Consulting firms and IT service providers operating delivery centers in India, Eastern Europe, or Brazil access client environments largely through corporate VPNs like this. A compromised customer-side gateway exposes the vendor's credentials, and a compromised vendor-side gateway paves the way for dozens of customers simultaneously.

What matters for the CISO

With the third flaw still unpatched, applying the released package reduces risk, but does not close the complete chain. The manual consolidated in 2024 remains valid: treat the device as potentially compromised if it has been exposed since early October, collect evidence before restarting, change credentials that passed through it, and check whether logs were deleted or disabled, a sign that Volexity has already pointed out as a strong indicator of compromise.

This incident adds an uncomfortable data point to the discussion on replacing VPNs with zero trust access models. For the second time in less than three years, the same product has been exploited in a chain before the vendor was aware of the issue, and this time the most current version was vulnerable. For boards asking if the company is "up to date with patches," the honest response in this case is that being up to date was not sufficient.