Ivanti Urges Emergency Patching as Connect Secure Zero

Ivanti has urged organisations to update affected Connect Secure VPN gateways immediately after confirming active exploitation of a newly disclosed vulnerability, raising concerns over the security of systems that provide remote access to corporate networks.

In its October 13 security update , the company said exploitation was limited at the time of disclosure and that it was working directly with affected organisations. Customers were advised to install the appropriate fixed release and continue checking appliance integrity.

The disclosure presents two related challenges for defenders: closing the vulnerability and determining whether attackers used it before an update became available. Restoring a gateway to a secure software version does not, by itself, establish whether credentials or internal systems were previously exposed.

Affected Versions Require Urgent Attention

The vulnerability, tracked as CVE-2026-104935 , affects Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier

The report describes a high-severity authentication bypass that can be exploited remotely without privileges or user interaction, enabling arbitrary command execution.

Connect Secure, previously known as Pulse Connect Secure, serves as a gateway for employees and contractors accessing organisational resources. Its position at the network perimeter makes the consequences of a successful intrusion potentially more extensive than an isolated application compromise.

Administrators should consult Ivanti’s security advisory for the fixed release appropriate to their deployment. Version numbers identify exposure, but a complete response also requires an inventory of where appliances operate, what systems they can reach and which accounts they use.

Three Flaws Combined to Gain Root Access

Volexity’s investigation identified a previously unknown actor, UTA0576, exploiting a fully patched appliance from October 3. The chain combined authentication bypass, code execution and privilege escalation to obtain root access.

The authentication bypass and code-execution components CVE-2026-104935 and received fixes on October 13. The separate privilege-escalation fix remained under development.

That distinction matters operationally. Closing the initial entry route can interrupt an attack chain even when a later component still awaits remediation. Organisations should therefore install the available update promptly and track subsequent vendor releases, while assessing whether an earlier intrusion requires additional recovery work.

Attackers Avoided a Persistent Backdoor

Volexity found no persistent backdoor or web shell: the actor repeatedly exploited the appliance to execute commands, returning results through HTTPS responses. It altered memory and removed log evidence, avoiding changes detectable by the Integrity Checker Tool.

The investigation used memory, disk and crash-dump evidence. Researchers also observed credential theft, reconnaissance and searches for LAPS passwords and BitLocker recovery keys through a compromised directory service account.

Volexity assessed criminal motivation with low confidence; the operation was disrupted before its ultimate objective became clear.

Why Directory Credentials Increase the Stakes

The targeting of administrative secrets brings identity security into the response. The risk extends beyond whether an attacker can log into the VPN: it includes what a compromised gateway’s accounts are permitted to read or do inside the organisation.

Microsoft’s Windows LAPS documentation explains that the feature manages and rotates local administrator passwords, helping reduce the danger of a shared password allowing movement between devices. Passwords backed up to Active Directory are protected through access controls and, optionally, encryption.

Those protections make the permissions surrounding stored passwords especially consequential. An organisation can deploy password rotation while still creating unnecessary exposure if too many accounts can retrieve administrative credentials.

Microsoft separately recommends enabling encryption for Windows LAPS passwords stored in Active Directory. For defenders reviewing a perimeter breach, the practical question is which secrets the compromised identity could actually access—not simply whether a password-management product was installed.

This is a risk assessment, rather than evidence that every affected Ivanti deployment exposed the same information. Directory permissions, account privileges and local configuration will determine the potential reach of any individual compromise.

A Clean Integrity Check Is Only One Piece of Evidence

Ivanti’s current guidance calls for regular use of its Integrity Checker Tool alongside patching. Its October security update also stresses access controls, network monitoring, log review and continuing validation of appliance integrity.

For incident responders, these measures answer different questions. An integrity check can identify certain unexpected changes; network records can reveal unusual connections; identity logs can show account use beyond its normal purpose. No single result should be treated as a complete account of activity across all three areas.

Where suspicious behaviour is present, responders should coordinate evidence preservation with containment. Rebooting or rebuilding a device can affect the evidence available for analysis, while leaving a suspected compromise connected can prolong exposure. The appropriate sequence depends on operational risk and the investigation.

Independent telemetry is particularly valuable when the trustworthiness of the appliance itself is in question. Logs already forwarded to a separate system can provide a different view from records retained only on the device.

Earlier Campaigns Show the Wider Perimeter Risk

The incident follows earlier exploitation of Connect Secure, although campaigns should not be treated as evidence of attribution in this case.

In research published in January 2025 , Mandiant documented exploitation of CVE-2025-0282 beginning in mid-December 2024. It attributed that activity to UNC5221, a suspected China-linked espionage actor.

Mandiant described malware capable of interfering with upgrades, including displaying a convincing but false upgrade process. It also documented techniques for maintaining access across upgrades, manipulating integrity-checking data and removing forensic evidence.

The researchers observed abuse of an appliance’s LDAP service account for directory queries and, in some cases, movement into internal systems through SMB or RDP.

Those historical findings explain why appliance recovery and identity review need to be considered together. They do not establish that the same malware, persistence methods or actor are involved in the October 2026 attacks.

Response Needs to Extend Beyond Installing the Update

For security teams, the immediate priorities are to establish exposure, apply the vendor’s fixes and determine whether evidence warrants an incident investigation. The following measures are broader defensive recommendations, rather than a substitute for Ivanti’s product-specific recovery instructions:

Account for every deployment. Include secondary gateways, disaster-recovery environments and appliances operated by service providers. Verify remediation. Record the installed release and confirm that each affected appliance completed the required upgrade. Review connected identities. Identify service accounts and secrets available to the gateway, assess permissions and coordinate credential replacement where exposure is suspected. Examine internal activity. Correlate gateway events with directory authentication, network connections and privileged account use. Preserve useful evidence. Involve incident responders early when suspicious activity could require memory or disk analysis. Track further fixes. Assign responsibility for following the outstanding privilege-escalation update and any revised recovery guidance.

Account for every deployment. Include secondary gateways, disaster-recovery environments and appliances operated by service providers.

Verify remediation. Record the installed release and confirm that each affected appliance completed the required upgrade.

Review connected identities. Identify service accounts and secrets available to the gateway, assess permissions and coordinate credential replacement where exposure is suspected.

Examine internal activity. Correlate gateway events with directory authentication, network connections and privileged account use.

Preserve useful evidence. Involve incident responders early when suspicious activity could require memory or disk analysis.

Track further fixes. Assign responsibility for following the outstanding privilege-escalation update and any revised recovery guidance.

For executives, completion should be measured by evidence of reduced exposure and a defensible assessment of prior access. A patch deployment report addresses the software defect; the accompanying investigation must establish whether the organisation faces a wider identity or network compromise.