Patching a compromised VPN appliance may close the vulnerability without invalidating credentials already stolen by attackers. That risk emerged after researchers uncovered three chained Ivanti Connect Secure zero-days used to steal credentials and access sensitive directory information.
The Cybersecurity and Infrastructure Security Agency (CISA) warned October 13, 2026, that attackers were exploiting CVE-2026-104935 to execute unauthorized commands remotely. The agency added the flaw to its Known Exploited Vulnerabilities catalog and urged immediate remediation. Organizations also need to investigate whether attackers accessed internal systems before the vulnerability was patched.
Ivanti exploit chain exposes credentials and directory data
CVE-2026-104935 is a high-severity vulnerability with a CVSS score of 8.6. It combines authentication bypass and remote code execution weaknesses affecting Ivanti Connect Secure, an enterprise VPN gateway.
An investigation by Volexity identified a threat actor, tracked as UTA0576, exploiting three vulnerabilities against an appliance running version 22.8R2.4, which was fully patched at the time. Exploitation began October 3.
The attack chain combined authentication bypass, remote code execution, and privilege escalation to gain root access. CVE-2026-104935 covers the first two weaknesses. The separate privilege-escalation flaw remained unpatched when Volexity published its findings October 13.
Attackers extracted stored LDAP credentials, exfiltrated limited Active Directory metadata, and searched for Windows LAPS passwords and BitLocker recovery keys. Separately, stolen remote-access credentials at US water utilities illustrate how exposed authentication data can create opportunities for unauthorized network access.
The attackers also modified code in memory, restored altered settings, and deleted selected logs. No persistent web shell or backdoor was identified on the investigated appliance. These techniques can evade Ivanti's Integrity Checker Tool, complicating detection. Similar risks arise when compromised security management systems expose internal networks.
Patch affected versions and investigate compromise
The Ivanti security advisory identifies affected releases through 25.1.1.1, 25.1.2.2, and 22.8R2.4 in their respective branches. Fixed releases include 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Administrators should verify the appropriate release and hardware compatibility before upgrading.
The CISA alert also calls for investigating potential compromise. Security teams should prioritize these actions:
- Patch and restrict access: Install the appropriate fixed release, limit unnecessary outbound connections, and restrict appliance access to critical internal systems.
- Investigate suspicious activity: Examine authentication logs, network traffic, and memory evidence for unusual requests to
/dana-na/auth/url_default/welcome.cgi, unexpectedX-DSCGI-PATHvalues, and suspicious files under/tmp/. - Preserve evidence and recover systems: Collect forensic data before factory-resetting compromised physical appliances or rebuilding virtual instances. Restore only reviewed configurations.
- Rotate credentials and limit privileges: Reset potentially exposed passwords, replace affected certificates and API keys, and audit LDAP and Active Directory service-account permissions.
- Strengthen monitoring and authentication: Enforce multifactor authentication where applicable, monitor unusual Kerberos and LDAP activity, and centralize security logs.
- Test incident response plans: Validate containment, lateral-movement investigations, credential rotation, and secure recovery procedures.
The National Vulnerability Database lists October 16, 2026, as the remediation deadline for covered US federal civilian executive branch agencies. A recent SharePoint exploitation case also illustrates how actively exploited vulnerabilities can trigger accelerated federal remediation requirements.
Installing the fix addresses the documented entry point, but stolen credentials may remain usable. Organizations must investigate downstream access to determine whether attackers reached systems beyond the VPN appliance.
Read more: A critical Citrix NetScaler vulnerability highlights the need to verify affected gateway configurations, install appropriate security updates, and test authentication services after upgrading.