CISA’s October 13 warning about Ivanti Connect Secure was not a precaution against a hypothetical flaw. Attackers had already used an authentication bypass and execution chain against an appliance that was fully patched for its branch at the time. The agency added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and set October 16 as the remediation deadline for federal civilian agencies.
The immediate software fix and the unresolved incident are different problems. Volexity’s investigation describes repeated exploitation, temporary memory changes, credential collection and selective log deletion, without a conventional persistent web shell. Updating the gateway closes the documented entry path; it cannot revoke secrets already stolen or establish that earlier access never happened.
The deadline and the affected releases
The flaw carries a CVSS score of 8.6. It allows remote command execution without an existing account or user interaction, with low attack complexity. Connect Secure sits between the internet, internal applications and identity services, so an authentication failure on this gateway gives an attacker a valuable trusted position.
The completed reporting identifies affected versions as 25.1.1.1 and earlier in that branch, 25.1.2.2 and earlier in that branch, and 22.8R2.4 and earlier in that branch. Listed corrected releases include 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. These are not an instruction to interchange branches: administrators must match their installation and supported upgrade path to Ivanti’s advisory.
The sources describe the older-release exception at different levels of precision: the primary report says 22.7.x and earlier, while the merged CVE-based report names 22.7R2.14 and earlier. Neither wording is a general security endorsement or a reason to downgrade. Older software may have unrelated vulnerabilities or unsupported lifecycle status.
The October 13 KEV update also added Windows Shell CVE-2026-96951, a separate issue requiring user interaction, unlike the direct unauthenticated Ivanti path. The two entries shared an October 16 deadline under the cited BOD 26-04 requirements for Federal Civilian Executive Branch agencies. Private organizations do not automatically inherit that directive’s obligations, but face the same technical exposure. The Windows issue is context here, not a second Ivanti vulnerability.
KEV inclusion establishes observed exploitation, not that every exposed device was breached or that exploitation was widespread. The catalog’s ransomware-use field was unknown, not a confirmed ransomware connection. Ivanti’s statement that it knew of limited exploitation likewise describes its visibility, not a reliable upper bound on victims.
A gateway considered current was attacked before disclosure
Volexity began investigating on October 5 and traced exploitation to October 3 on Connect Secure 22.8R2.4, Build 19097, then current for that branch. A separate threat-intelligence provider reportedly saw related signs from October 1. Those are distinct observations; the earlier report should not be presented as Volexity’s confirmed first date.
The firm tracks the unidentified activity as UTA0576. That is an analytical cluster label, not a proven real-world identity or government sponsor. It assessed a criminal rather than espionage motive with low confidence. The operation was disrupted before investigators established the final objective.
Ivanti said part of the flaw was found through its product-security program and fixed in the July 2026 release of 25.1.3.0. Exploitation occurred while the company was backporting the fix to other supported versions. That left a real cross-branch protection gap, but the public account does not establish when Ivanti understood the entire chain or knew of exploitation. Backporting and compatibility work should not be replaced by an unsupported claim of deliberate delay.
The background includes exploited Connect Secure flaws CVE-2025-0282, a January 2025 stack buffer overflow, and CVE-2025-22457, later associated with China-linked espionage. Those incidents do not identify UTA0576 or prove every Ivanti appliance unsafe. Volexity also compared credential recovery from packet captures with attacks on SonicWall remote-access appliances, illustrating the broader appeal of trusted edge infrastructure.
Three weaknesses turned public access into root
The reconstructed chain began with a disagreement between authorization and routing. A request to the public login component, welcome.cgi, could carry a different destination in the X-DSCGI-PATH header. The appliance checked the public URL but routed the request to a protected upload handler, wu.cgi.
The upload handler then wrote a file before validating that it was a ZIP archive. An attacker-supplied Perl script disguised with that extension existed briefly before rejection and deletion. Parallel requests raced that cleanup window, allowing execution under the restricted cgi-server account. This is a timing-dependent file-handling failure, not evidence that ordinary ZIP files are inherently executable.
Ivanti grouped the authentication bypass and remote-execution stages under CVE-2026-104935. A separate privilege-escalation weakness involved a privileged service trusting manipulated configuration and an in-memory library change. A legitimate maintenance task was redirected to a malicious script and executed as root. The operator tested access to protected password information, then restored configuration and the altered memory instruction.
At the time of the completed reports, Ivanti planned a later fix for that separate escalation weakness. This does not mean the October 13 update leaves the documented unauthenticated route open: interrupting the entry and execution stages breaks that particular chain. It does mean follow-up vendor releases remain relevant.
The operator repeatedly used the exploit channel to send commands and receive results over HTTPS rather than leaving a first-stage backdoor. Some stages ran only in memory, including a compressed, encoded Python payload. Selected debug and Linux audit records were removed, temporary files and results were cleaned up, and modified state was restored.
Volexity found that this approach evaded Ivanti’s Integrity Checker Tool. The tool looks for unexpected file changes; temporary memory modifications and restored configuration fall outside what a clean disk-oriented result can establish. That limits the meaning of a clean check, rather than making integrity checking useless.
Identity data made the impact larger than one appliance
The gateway’s directory access gave the attacker a way to query an internal Active Directory domain controller. Investigators recovered a custom LDAP utility and Python scripts targeting LAPS local-administrator credentials, BitLocker recovery information, password-bearing attributes, user metadata and logon-script paths. Authentication records also supplied valid usernames.
LAPS credentials can unlock local administrative access; BitLocker recovery data can unlock encrypted drives. Volexity assessed with high confidence that information available through the targeted directory queries was exfiltrated. That does not establish that every requested secret was present or that every later compromise succeeded.
The operator also inspected packet captures for plaintext LDAP credentials, HTTP Basic Authentication material and NTLM challenge-response hashes. A renamed capture utility in a hidden directory monitored plaintext protocols including LDAP, HTTP, FTP and Telnet, using eight rotating capture files. Hash abuse and offline cracking risks depend on configuration and password strength, but collecting this material creates work that a VPN update cannot undo.
Additional activity included internal DNS and hostname reconnaissance, searches of VPN configuration and authentication logs, and password spraying across directory accounts. The combined behavior supported preparation for lateral movement and broader access. Investigators did not establish the actor’s final objective or prove that every attempted technique succeeded.
A related claim in the merged report also requires restraint. Volexity assessed with medium confidence that large language models were used during exploit development or post-exploitation, citing tailored scripts, hardcoded credentials, repeated use of the command channel and the chain’s complexity. That is an inference, not direct proof. Human iteration or existing private tooling could produce similar patterns; this should not become a claim of a confirmed autonomous AI intrusion.
What a defensible response needs to establish
Shadowserver counted more than 5,500 apparent internet-facing Connect Secure instances after disclosure. That is an exposure observation, not a count of vulnerable or compromised customers: honeypots, duplicate observations and updated systems can appear. Inventory should include active and standby gateways, recovery nodes and forgotten test appliances, then verify the actual installed build.
Ivanti advised immediate updating and regular integrity checks; Rapid7’s analysis additionally emphasized searching for compromise after patching. Exposure dates, gateway-originated connections, identity and directory logs, firewall and DNS telemetry, and preserved memory can answer questions that a version check cannot. Volexity highlighted unusual request volumes to welcome.cgi and URL/header mismatches, but attackers can alter patterns; absent published indicators are not universal clearance.
Containment and evidence preservation can conflict. Rebooting or rebuilding may destroy volatile artifacts, while delaying isolation may extend attacker access. Active risk, redundancy and forensic capability determine the sequence. Incident responders should coordinate collection without unnecessarily prolonging access and document actions and times.
Credential rotation should follow the gateway’s integrations, accessible secrets and observed activity. Service credentials, local-administrator passwords, recovery keys, tokens and reusable user secrets deserve separate consideration. Blind resets can disrupt dependencies yet miss less visible credentials. Downstream connections from a trusted gateway require review in their own right.
The longer-term boundary matters too: restrict unnecessary internet and administrative exposure, centralize logs, limit directory-service account privileges, segment internal access and remove plaintext authentication where possible. Such measures do not eliminate zero-days; they reduce what one compromised appliance can reach and what evidence it can erase.
The useful next signals are additional exploitation or victim findings, verified coverage across supported branches, the separate escalation fix, and evidence of downstream use of stolen credentials. Volexity withheld weaponized exploit code, but public technical analysis can still assist imitators. A lack of further public cases would not prove absence of compromise.
For closure, organizations need separate answers about vulnerable versions, exposure during the exploitation window, evidence of access and the systems or secrets reachable afterward. A completed patch answers the first question. It is a necessary milestone, not a substitute for the other three.