Ivanti VPN Zero-Day Chain Steals Credentials; Clean Integrity Checks May Miss It

Volexity disclosed active exploitation of Ivanti Connect Secure on October 13, 2026, after investigating a customer's appliance. Ivanti published the corresponding CVE record the same day. ## Affected systems Ivanti's record identifies Connect Secure as affected by CVE-2026-104935, an authentication-bypass vulnerability rated 8.6. It lists 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14 as unaffected, and says 22.7R2.14 and earlier are not impacted. Administrators should check the vendor advisory for their release branch rather than apply a single version comparison across all branches. ## Access path The vendor record says a remote attacker needs neither authentication nor user interaction to execute commands. Volexity observed an authentication-bypass, code-execution and privilege-escalation chain on a previously fully patched 22.8R2.4 appliance, with activity beginning October 3. ## Impact Volexity found credential theft, Active Directory data exfiltration, reconnaissance and log tampering. The VPN became a foothold for attempts to reach internal resources. ## Mitigations Move affected appliances to the vendor's fixed release for their branch. Volexity recommends network and memory forensics for suspected compromise: the observed chain avoided persistent disk changes, so a clean Integrity Checker result is not proof of safety. Patching blocks the repaired entry path; it does not retrospectively clear a device or exposed credentials. ## Uncertainty Volexity reports that a separate privilege-escalation fix remains pending. Its investigation does not establish the campaign's total size or final objective. The actor label UTA0576 is a tracking identifier, not a confirmed identity or government attribution. ## Sources The vendor's version record and the responder's incident findings answer different questions. Preserve both when assessing exposure and remediation.