Ivanti VPN Zero-Day: Patching Alone Is Not Enough

On October 13, 2026, Volexity reported real-world attacks on Ivanti Connect Secure, a VPN appliance many organizations use for remote access. The attacker chained three zero-day flaws to gain root control without logging in. Ivanti has patched only two of them so far, which makes checking your own VPN gateway this week a sensible priority.

What Volexity reported

A zero-day is a flaw attackers exploit before the vendor has a fix ready. According to Volexity’s report, an actor it tracks as UTA0576 began exploiting the chain on October 3, 2026. Volexity started investigating on October 5 after spotting odd activity at one of its network monitoring customers. The victim’s appliance was running version 22.8R2.4, fully patched at the time.

Ivanti Connect Secure is a VPN gateway: employees or teachers sign in through one door and reach the intranet, finance apps, and shared files from home. Because it sits at the edge of the network and faces the internet, devices like this are attractive targets. Whoever controls the door can watch everything that passes through it.

The timeline is short. The attacker’s server ran OpenVPN from September 30 to October 7, repeated exploitation began October 3, related indicators went to Volexity’s threat intelligence customers on October 10, and the public report and the patch landed together on October 13. In other words, for roughly ten days even an up-to-date appliance could be breached with no fix available to install.

The attack chain has three steps, and Volexity describes them in detail.

Step one skips the login process. Step two abuses a file-writing flaw so the attacker’s code can run before it is validated. Step three alters part of a library in memory so a privileged service runs the attacker’s code as root, then restores everything to its original state. The first two steps are tracked as CVE-2026-104935. The third, a privilege escalation, has no CVE ID in the report.

What is patched and what is not

According to Volexity, Ivanti released patches for CVE-2026-104935 on October 13. The fix for the root-level escalation flaw, The Hacker News reports, is promised by Ivanti “in a future release in the coming weeks.” Neither Ivanti nor Volexity names a temporary workaround for organizations that cannot upgrade yet.

One thing needs careful reading: the sources disagree on which versions are affected and which are safe. Volexity lists 25.1.1 and earlier, 25.1.2, and 22.8R2.4. BleepingComputer writes 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. The Hacker News, citing the CVE record, writes versions before 25.1.3.0. On severity, The Hacker News reports a CVSS score of 8.6, while BleepingComputer gives no number. We could not open Ivanti’s advisory page directly, so the final reference is the vendor’s own advisory for the version you run.

Why “patched” does not mean “safe”

The biggest lesson here is not about version numbers but about traces. Volexity says the attacker left no web shell or backdoor. Each command was sent again through the same exploit chain, so there is no permanent malicious file to find. The attacker also deleted parts of the logs and restored the in-memory changes.

As a result, Ivanti’s Integrity Checker Tool does not detect this chain. Ivanti still recommends running the tool regularly, but Volexity stresses that a suspect device needs network and memory forensics. A clean result from one tool is not proof that the appliance is safe.

Once inside, the attacker in Volexity’s case moved toward Active Directory. They took credentials stored on the device, searched the directory for passwords, and tried password guesses against other accounts. The credentials they went after included LAPS passwords and BitLocker recovery keys. So the damage is not limited to one VPN box; it reaches the internal network behind it.

Two cautions apply. Volexity assesses with low confidence that the motive is criminal rather than espionage. It also assesses, with medium confidence, that the actor used large language models (LLMs) to build the exploit and post-exploitation tools, based on the command channel design and the chain’s complexity. That is an analyst’s judgment, not a confirmed fact. On scale, BleepingComputer cites Shadowserver tracking more than 5,500 internet-exposed Connect Secure instances, noting it is unclear how many are honeypots or already secured. Even the start date varies: BleepingComputer says Defused saw the first signs of exploitation on October 1, while Volexity records October 3.

What this means for your organization

First, find out whether you run Ivanti Connect Secure, including under its older name, Pulse Connect Secure. Many agencies and companies in Indonesia have VPNs installed by an integrator, so leadership sometimes does not know the brand. Ask your IT team or vendor.

Apply the available patch now. Do not wait for the root-level fix. The CVE-2026-104935 patch breaks the first two steps of the chain, closing the entry point that needs no login. Plan the next update for when Ivanti ships it.

Monitor, and do not trust built-in tools alone. Volexity suggests watching for spikes in requests to welcome.cgi, and for requests whose X-DSCGI-PATH header does not match the URL path. Also check the /tmp/ directory for suspicious artifacts. If there are signs that the VPN appliance was the starting point for movement to other servers, treat it as compromised.

Prepare a credential plan. Because the attacker targets directory credentials, ask your team: if the VPN appliance were proven compromised, which accounts must be changed first? Answering that before an incident is far cheaper than answering it in a panic.

Limit what the VPN can reach. Staff access should be limited to the applications they actually need, not the whole network. This does not close the flaw, but it shrinks the damage if the gateway falls. We covered the same “patch and you are done” mindset in our articles on the critical GitLab flaw and on the shrinking patch window.

Picture a university that gives lecturers VPN access to the grading system from home, or an agency that lets field staff reach internal apps. In both cases the VPN gateway matters as much as the servers it protects, yet it often slips off the asset list because it is “just network equipment.” Moving it up the priority list is a cheap step with a big payoff.

Organizations without a dedicated security team can start with a simple audit: a list of internet-facing devices, who owns each, and how long it takes from hearing about a flaw to finishing the update. Cybersecurity services can help design and test that routine.

Frequently asked questions

Are we affected if we do not use Ivanti?

This flaw is specific to Ivanti Connect Secure. The pattern, however, applies to any internet-facing VPN or firewall: know which devices you have, which versions they run, and who follows their security news.

Is running the Integrity Checker Tool enough?

Not for this case. Volexity says the tool does not detect this attack chain, and Ivanti still recommends running it regularly as one layer. If you suspect compromise, network and memory forensics are needed.

Will updating remove an attacker who is already inside?

Neither Ivanti nor Volexity says. Because an attacker may have taken credentials before the patch was installed, update the device and also review and, where needed, change the credentials stored on it.

Closing: guard the front door most carefully

A VPN is the front door of a modern network, and this case is a reminder that patching does not always close the story. A clear asset list, monitoring that does not depend on one tool, and a credential plan ready to use are often worth more than adding new devices. If you would like a partner to assess your remote access readiness and cloud infrastructure, our team is happy to talk via the contact page.

Sources

• Volexity: A Series of Unauthenticated Events, Chained Exploitation of Ivanti Connect Secure Zero-Days, October 13, 2026
• The Hacker News: Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, October 13, 2026
• BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks, October 13, 2026