A newly disclosed vulnerability in Ivanti Connect Secure is already being weaponized against live corporate networks, according to a warning from the Cybersecurity and Infrastructure Security Agency. The flaw, tracked as CVE-2026-104935, allows attackers to bypass authentication entirely and run commands on vulnerable appliances without credentials - a combination that turns remote-access infrastructure meant to protect networks into an open door.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, confirming that exploitation is not theoretical. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The agency is urging immediate patching in line with Ivanti's advisory and migration documentation.
How the Breach Unfolded
The security firm Volexity first spotted signs of compromise on October 5 on an appliance that was, at the time, running a fully patched version of the software. Investigators traced the actual intrusion back to October 3 and attributed it to a threat actor designated UTA0576. The attack chained together the authentication bypass with remote code execution and a separate, still-unpatched privilege escalation flaw - Ivanti plans a distinct future fix for that third component.
The mechanics reveal a methodical actor. Attackers exploited inconsistent request routing to reach restricted backend functionality through a login endpoint that required no credentials. A flaw in how the system handled file uploads then opened a narrow window to execute an uploaded script before it was automatically deleted - enough time to load further stages that ran as Python code directly in memory, leaving little trace on disk.
To escalate to root access, the attacker manipulated in-memory configuration tied to the appliance's privileged dsinvoked service, hijacking a routine maintenance task to run malicious code instead. Afterward, the payload quietly restored the altered configuration and memory state, erasing much of the evidence a forensic review would normally rely on.
What Was Stolen
Once inside, the attacker harvested credentials stored on the appliance, including domain credentials used for LDAP authentication. With a compromised Active Directory service account in hand, custom tools then searched directory data for Local Administrator Password Solution entries, BitLocker recovery keys, and other password-bearing attributes - the kind of material that, once exposed, can unlock far more than the original appliance.
The campaign also included password spraying, review of authentication logs, internal DNS reconnaissance, and collection of configuration data. Packet capture analysis targeted plaintext LDAP credentials, HTTP Basic Authentication data, and NTLM challenge-response hashes - a layered approach aimed at extracting reusable secrets rather than simply maintaining a foothold.
Notably, UTA0576 avoided installing a persistent web shell. Instead, the actor repeatedly re-triggered the exploit chain and retrieved command output through ordinary HTTPS responses, a technique that blends into normal traffic. Selected debug and Linux audit log entries were also deleted, complicating any retrospective investigation.
Why Standard Detection May Fail
CISA has cautioned that Ivanti's own Integrity Checker Tool may not catch this activity, since the attacker's commands execute in memory rather than writing persistent files to disk. Organizations checking for compromise need network traffic analysis and memory forensics, not disk-based integrity checks alone - a distinction that matters because many incident response playbooks still default to file-system review first.
Recovery Beyond a Simple Patch
For organizations suspecting compromise, CISA recommends backing up appliance configuration, performing a factory reset, applying the update, and then restoring configuration data. Cloud and virtual deployments should instead be rebuilt from scratch and upgraded before any configuration is restored, since a compromised image cannot be trusted to clean itself.
- Reset domain, administrator, and local account passwords
- Revoke and reissue all certificates stored on the appliance
- Replace stored API keys and license server credentials
These steps exist because stolen secrets - passwords, certificates, keys - remain valid and usable even after the underlying software vulnerability is patched. A fixed appliance does not undo a stolen credential. Organizations still running the 22.8 branch face an added deadline: that version reaches end of life on January 31, 2027, meaning migration planning cannot be treated as optional alongside the immediate patching effort.