A newly disclosed authentication bypass in Ivanti Connect Secure is already being weaponized against live enterprise networks, according to a fresh advisory from the Cybersecurity and Infrastructure Security Agency. The flaw, tracked as CVE-2026-104935, allows attackers with no credentials at all to execute commands remotely on vulnerable VPN appliances - a category of device that sits at the front door of corporate networks and, when breached, can expose everything behind it.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026, confirming that exploitation in the wild preceded public disclosure. Affected releases include version 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier - a range broad enough to touch a large share of organizations still running on-premises remote access infrastructure. Enterprises weighing whether to stay with appliance-based VPN systems or shift toward alternative remote access architectures may find it useful to compare plans before deciding how to rebuild their access layer once patched. compare plans
How the Attack Chain Works
The investigation, carried out by Volexity after suspicious activity surfaced on October 5 against an appliance that was, at the time, fully patched to version 22.8R2.4, traced the intrusion back to October 3. The attacker, tracked as UTA0576, chained the authentication bypass with remote code execution and a separate privilege escalation bug that Ivanti has not yet patched. Volexity says a fix for that second flaw is still forthcoming.
Technically, the attack exploited inconsistent request routing to reach protected administrative functions through a login endpoint that required no authentication at all. A flaw in how the appliance handled file uploads then opened a brief window during which an uploaded script could execute before the system deleted it - enough time for attackers to load and run Python code entirely in memory, leaving little trace on disk. To gain root-level control, the intruders manipulated in-memory configuration tied to the privileged dsinvoked service, hijacking a routine maintenance task to run malicious code. Afterward, the payload quietly restored the original configuration and memory state, erasing much of the evidence that an intrusion had occurred.
Credential Theft and Lateral Movement
Once inside, the attackers harvested credentials stored on the appliance, including domain accounts used for LDAP authentication. Using a compromised Active Directory service account, custom tooling then searched directory data for Local Administrator Password Solution passwords, BitLocker recovery keys, and other password-bearing attributes - information that, if obtained, can unlock far more than the VPN itself. Investigators also observed password spraying, review of authentication logs, internal DNS reconnaissance, and systematic collection of appliance configuration data, alongside packet capture activity aimed at harvesting plaintext LDAP credentials, HTTP Basic Authentication data, and NTLM challenge-response hashes.
Rather than planting a persistent web shell, UTA0576 repeatedly re-triggered the exploit chain itself, retrieving command output through ordinary HTTPS responses - a method that blends into normal traffic and avoids leaving a standing implant for defenders to find. The group also deleted selected debug and Linux audit log entries, a deliberate effort to frustrate forensic reconstruction.
Why Standard Checks May Not Catch It
CISA has cautioned that Ivanti's Integrity Checker Tool, which inspects disk contents for unauthorized changes, may fail to detect this intrusion because the malicious commands run in memory rather than being written to storage. Organizations suspecting compromise need network traffic analysis and memory forensics, not disk checks alone, to confirm whether they have been affected.
For confirmed or suspected compromises, CISA's recommended recovery path is demanding: back up the appliance configuration, perform a factory reset, apply the upgrade, and only then restore configuration data. Cloud and virtual deployments should be rebuilt from scratch and upgraded before any configuration is reapplied. Because stolen secrets cannot be invalidated by a software patch alone, full recovery also requires resetting domain, administrator, and local account passwords, revoking and reissuing certificates, and replacing stored API keys and license server credentials. Organizations still running the 22.8 branch should factor its January 31, 2027, end-of-life date into migration planning, since continued use beyond that point will leave them without vendor support for a system already shown to be a target.
