Skip to content
Indene
en

Alertas de segurança

Ivanti Connect Secure Vulnerability Exploited, Part of Attack Chain Remains Unpatched

Ivanti confirmed the exploitation of CVE-2026-104935 in its Connect Secure VPN, with attacks since early October and theft of Active Directory credentials. The update fixes two of the three flaws in the chain: organizations need to patch and look for signs of intrusion.

By Rafael LimaCFO

3 min read

Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título The patch closes the door, not the case.
Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título The patch closes the door, not the case.

On October 13, 2026, Ivanti confirmed that a vulnerability in Connect Secure, the company's corporate VPN, was exploited against customers before a fix was available. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on the same day. The update fixes two of the three flaws used in the attack; the third, which grants full privileges on the device, still has no fix.

What is known

item detail
Identifier CVE-2026-104935
Affected product and versions Ivanti Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier, 25.1.2.2 and earlier; versions 22.7 and earlier are not affected
Severity CVSS v3.1 8.6 (Ivanti, in NVD)
In CISA's KEV catalog yes, since October 13, 2026 · U.S. federal deadline on October 16
Fix 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1, according to the vendor's advisory
Still unpatched the privilege escalation flaw used in the same chain; according to Volexity, Ivanti is preparing the fix for the coming weeks

The vulnerability allows an attacker to bypass authentication and run commands on the device without logging in. According to Volexity, which investigated the case, the attacker chained this flaw with two others to gain full administrator (root) access on fully updated devices, since at least October 3. Defused, another threat intelligence company, saw the first signs on October 1. Ivanti describes the exploitation as "limited." Shadowserver counted more than 5,500 Connect Secure devices exposed on the internet, according to BleepingComputer.

Why it matters for financial institutions

The target was not the VPN itself. According to Volexity, once inside, the attacker stole domain credentials passing through the device, searched Active Directory for local administrator passwords and disk recovery keys, and took data out of the network. No malware was installed either: the attacker re-exploited the flaw for each command and deleted logs. This is why Volexity warns that Ivanti's integrity checking tool may not detect the compromise.

This is the scenario of an exploited internet-facing asset leading directly to corporate account compromise. It is also the third wave of exploited flaws in edge devices in less than a month, after F5, Check Point, WSO2 and Arista in September, and Citrix and Cisco in early October. Connect Secure has a history: CISA has flagged 36 Ivanti vulnerabilities as exploited since November 2021, 12 of them by ransomware groups, according to BleepingComputer.

For organizations running the device, updating is mandatory, but it is not enough. With one of the flaws still open and the attacker erasing traces, the right question is not "have we patched?" but "can we prove that no one got in between October 1 and today?"

What to do now

  1. Check whether your institution, or a vendor that runs remote access on its behalf, uses Ivanti Connect Secure in an affected version and whether the device is reachable from the internet.
  2. Apply the fixed version listed in Ivanti's advisory (22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1) and track the privilege escalation fix, which has not been released yet.
  3. Look for signs of unauthorized access since October 1 using the indicators published by Volexity, such as an abnormal volume of requests to the authentication page and unusual files in the temporary directory, without relying only on Ivanti's integrity tool.
  4. If there are signs of compromise, reset the domain credentials that passed through the VPN, the local administrator passwords and the disk recovery keys stored in Active Directory, and preserve logs and images for the investigation.
  5. Record the fix and the verification with the date and the person responsible: this is the evidence auditors will ask for.

References

Topics

Keep reading

All news