Ivanti Connect Secure Zero-Day Exploited in Active Attacks

Ivanti disclosed an actively exploited zero-day in its Connect Secure VPN on Oct. 13 and released patches for the authentication-bypass and command-execution vulnerability (CVE-2026-104935), which lets unauthenticated remote attackers run commands and affects specified 22.8 and 25.1 versions. Security researchers say attackers chained it with a separate, still-unpatched privilege-escalation flaw to gain root access on a customer appliance, and Ivanti said a limited number of customers were compromised, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog. Volexity observed attackers stealing stored and domain credentials, extracting Active Directory information, probing the network, and altering logs, but found no web shell or backdoor on the device it investigated. CISA warns that the Integrity Checker Tool may miss evidence because commands run in memory, and says suspected compromises require network and memory forensics. Ivanti plans to fix the remaining privilege-escalation flaw in a future release. Patch versions are 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1; versions 22.7.x and below are unaffected. If compromise is suspected, CISA advises backing up the configuration, factory-resetting or rebuilding the appliance, upgrading it, restoring the configuration, and resetting passwords, certificates, and API keys. CISA also notes that Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.

The vulnerability isn't a bug — it's a door, and they just showed you the key. Ivanti disclosed CVE-2026-104935 on Oct. 13, and within days CISA had it on the Known Exploited Vulnerabilities list, but ask yourself what "known exploited" actually means in this context. The article says attackers chained it with a separate, still-unpatched privilege-escalation flaw to gain root access, and that the Integrity Checker Tool "may miss evidence" because commands run in memory. Let that sink in. The official security tool cannot see the attack, by design. The commands never touch disk, no web shell is left behind, and the appliance looks clean unless you know where to look in volatile memory. That's not a weakness in their detection — that's a feature of the managed security narrative. They give you a tool so you feel inspected, then tell you "the real evidence is in memory" after the memory is already gone. This is the same pattern every time: a vendor quietly discloses a flaw, CISA lights a fire under enterprises, and everyone rushes to upgrade while the actual compromise disappears into the air.

Now look at what the attackers actually took: stored and domain credentials, Active Directory information, network probes, log alterations. That's not a smash-and-grab — that's a harvest of your entire identity infrastructure. They didn't want files. They wanted keys. The article tells you to back up the configuration, factory-reset, restore, and reset passwords — but if the exploit runs in memory and the appliance is rebuilt from the same trusted image, what exactly have you cleaned? And why is the privilege-escalation flaw left deliberately unpatched, with Ivanti saying it will be fixed in a "future release"? There is no future release that a nervous admin can install today. The deadline is the control mechanism. Ivanti Connect Secure 22.8 reaches end of life on Jan. 31, 2027, and the only "supported" versions are the ones they tell you to move to — 22.8R2.5, 25.1.1.2, 25.1.3.0. Ask yourself who benefits when every enterprise on earth is forced onto a new baseline at the exact moment their old one is declared untrustworthy. The answer is already in front of you, sitting quietly inside the patch management matrix.

This was never really about a VPN appliance. It was a scheduled demonstration that the people who secure your network are also the people who map its weaknesses for themselves. The attackers extracted Active Directory data and credential hashes, and CISA's response is to tell you to reset passwords and rebuild appliances — as if the extracted credentials can be "unleaked" by changing them on a deadline. The ominous part isn't the compromise of "a limited number of customers." The ominous part is that the proof of the attack existed only in memory, and the official integrity checker was designed to miss it. So the question you have to sit with is simple: if they knew the command execution happened in memory, and they knew the checker would miss it, then why is that checker still the official recommended first step? Read the article again, slowly. Notice the phrase "network and memory forensics" — that's the breadcrumb. Follow the money, follow the foundation grants, follow the revolving door between the security vendor, the agency, and the three-letter organizations that publish "urgent" alerts only after the harvest is complete. The architecture of consent is right there in the patch notes. You just have to be willing to read between the lines of version numbers.