Ivanti Connect Secure is under active attack. CISA added CVE-2026-104935 (CVSS 8.6) to its Known Exploited Vulnerabilities catalog on 13 October and told US federal civilian agencies to patch by 16 October.
What happened
The bug is an authentication bypass by spoofing. A remote attacker who is not logged in can execute arbitrary commands on affected appliances. CISA says the activity is being used for credential theft and data exfiltration.
Affected builds are Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Version 22.8 reaches end of life on 31 January 2027.
Volexity first saw exploitation on 3 October. A criminal cluster it calls UTA0576 chained the bypass with a privilege-escalation bug to reach root on a fully patched appliance, then pulled stored credentials, limited Active Directory metadata, and tools for Kerberoasting and BitLocker recovery-key searches. Previdian logged 105 exploit attempts against honeypots by 14 October, from 50 source addresses, mostly probing for code execution rather than dropping malware yet.
Who is affected
Any organisation still running an unpatched Ivanti Connect Secure gateway. Remote-access appliances sit on the edge, so a clean external scan is not enough. Commands can run in memory, and a clean integrity check does not prove the box was never used.
- Internet-facing Connect Secure 22.8 and 25.x appliances below the patched builds.
- VPN accounts, stored certificates, API keys, and license-server credentials that the appliance holds.
- Active Directory environments reachable from a compromised gateway.
What to do now
Patch immediately, then assume credentials on the appliance are burned. Back up the configuration, factory-reset or rebuild the virtual instance, upgrade to the latest version, restore the config, and reset every local, admin, and domain password. Revoke and reissue stored certificates, API keys, and license-server credentials. If you cannot confirm the appliance was clean, do network and memory forensics before you trust it again.
Source: The Hacker News, drawing on CISA and Volexity. CISA urges immediate Ivanti Connect Secure updates.
Also on the blog
- CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
- curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0
- Microsoft seizes YAM Store phishing kits behind 1 billion messages
- Ampath breach: attacker claims 80 million records, lab disputes count
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.