Ivanti VPN Zero-Day: CISA Warns Hackers Are Chaining Three Flaws to Take Over Patched Appliances

Also on CyberFence: CyberFence Breach Monitor for scheduled checks and alerts · run a free breach check on your email .

On October 13, 2026, Ivanti told customers to act immediately on a zero-day flaw in Ivanti Connect Secure, a VPN gateway that companies run to let employees reach internal systems. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog and said that threat actors are exploiting it "to conduct credential theft and data exfiltration."

If you do not run an Ivanti appliance, none of this changes your day. But the details are a clear look at how VPN gateways get taken over, and what attackers go after once they are in. Here is what is confirmed, what is still open, and what to do.

What Happened

The flaw is tracked as CVE-2026-104935. According to BleepingComputer, it is an authentication bypass that lets a remote attacker with no privileges run arbitrary commands on an Ivanti Connect Secure appliance, in low-complexity attacks that need no user interaction. It affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.

Cybersecurity firm Volexity found and reported it. Volexity says a previously unknown threat actor it tracks as UTA0576 has chained the flaw with two others since at least October 3 to get unauthenticated root-level code execution on fully patched devices. The threat intelligence firm Defused says it saw the first signs of exploitation starting October 1. Ivanti said at disclosure that it was aware of "limited exploitation in the wild."

Here is the timeline as reported so far:

• October 1: Defused reports the earliest signs of exploitation.
• October 3: Volexity says the actor had been chaining the flaws since at least this date.
• October 13: Ivanti publishes its advisory and patches for two of the flaws, and CISA adds the vulnerability to its catalog of known exploited flaws.
• October 16: the deadline CISA set for US federal civilian agencies, according to Help Net Security.

That gap matters. For at least ten days before the public warning, an attacker was using this chain against a limited number of customers.

Three Flaws in One Chain

As Help Net Security summarizes Volexity's analysis, the chain has three parts:

• An authentication bypass in a login-related script, which lets the attacker reach functions that should be locked.
• A file-write flaw in a file-upload script, which lets the attacker write a file on the appliance.
• A privilege-escalation flaw that takes the attacker from a limited account to root, because a system component trusts configuration data it should not.

Ivanti patched the first two, which are tracked together as CVE-2026-104935. At the time of disclosure it was still working on a fix for the third. That matters: a patched appliance can still be exposed to the root-level step until the last fix ships, so check Ivanti's advisory for current guidance.

Why Patching Is Not the Whole Answer

Two details make this more serious than a routine bug.

First, the compromised appliance was running Ivanti Connect Secure 22.8R2.4, which Help Net Security describes as fully patched at the time. Ivanti said it had patched part of the problem in a July release, 25.1.3.0, and was working to backport the fix to other supported versions when exploitation began.

Second, the attacker was hard to see. Volexity reports that UTA0576 deployed no malware or web shell. The actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, which evaded Ivanti's Integrity Checker Tool. Volexity says the exploit chain "patches library code in memory only and restores configuration store data," so finding it takes forensic work. CISA agrees: organizations that want to know whether they were compromised "will need to conduct network and memory forensics."

What the Attackers Went After

This is the part that matters for everyone. Once the attacker had control of the VPN appliance, Help Net Security reports, the actor:

• Extracted credentials stored on the appliance.
• Collected local administrator passwords and BitLocker recovery keys.
• Exfiltrated some Active Directory metadata and configuration data.
• Captured LDAP traffic from the compromised appliance.
• Conducted network reconnaissance, then cleaned up logs and temporary files.

Volexity assessed with high confidence that this was preparation for lateral movement and a broader compromise of the victim network. It could not say what the attacker ultimately wanted, because the operation was detected and disrupted. The pattern is familiar: the VPN gateway is valuable because it sits at the edge and holds keys to everything behind it. We covered the same dynamic in why hackers keep targeting VPN gateways.

If You Run Ivanti Connect Secure

1. Update now. CISA urges organizations to immediately update to the latest version as outlined in Ivanti's advisory. Ivanti released 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
2. Assume patching is not proof of safety. Run the Integrity Checker Tool as Ivanti advises, but know that Volexity says it may not detect this activity. Use the indicators Volexity published, and consider outside help for memory forensics.
3. If you suspect a compromise, follow Ivanti's recovery steps, which CISA lists: back up the configuration, factory reset and upgrade, rebuild virtual instances, restore the configuration, then reset passwords for all accounts, including domain, administrator and local accounts. CISA also says to revoke and reissue stored certificates, and reset stored API keys and license server credentials.
4. Plan your upgrade path. CISA notes that version 22.8 reaches end of life on January 31, 2027.

Help Net Security reports that CISA set a deadline of October 16 for US federal civilian agencies to address the flaw and perform forensic triage. Private organizations do not have a deadline, but the exploitation is real.

What This Means If You Do Not Run Ivanti

Most individuals and small businesses do not host a VPN appliance, so this specific flaw does not reach them. Be careful about the opposite mistake, though. Nothing here means a different VPN is immune, and we are not claiming that. Every system has bugs. The practical lesson is about where the risk sits.

• Stolen credentials are the real prize. The attacker harvested passwords and keys because they unlock other systems. Unique passwords and two-step sign-in limit what one stolen password can do. See our guide to credential stuffing.
• You will not always know. The attacker erased evidence. If your email address or password appears in a leak, an alert tells you sooner. Breach Monitor, a separate CyberFence product, does that. See what Breach Monitor is.
• Phishing follows breaches. Stolen data fuels convincing scam messages. Web Shield DNS blocking can stop known phishing and malware domains before a page loads. It will not catch a brand-new site. More in how DNS filtering works.
• Your connection still needs protection. On hotel, airport, or cafe Wi-Fi, AES-256-GCM encryption and a kill switch protect your traffic. That is a different job from securing a company gateway.

To be clear about limits: CyberFence does not patch or protect an Ivanti appliance, it is not a firewall, and it is not a replacement for a company's remote-access system if staff need to reach internal servers. Our guides on VPNs versus firewalls, zero trust versus VPN, and whether a VPN can be hacked explain where each tool fits.

A Short Checklist for Small Businesses

• List every system exposed to the internet for remote access, including old ones nobody remembers.
• Subscribe to your vendors' security alerts, and patch internet-facing systems first.
• Turn on two-step sign-in everywhere it is offered.
• Reset shared and administrator passwords after any suspected breach.
• Decide in advance who gets called when a warning like this one arrives.

The Bottom Line

The takeaway from this CISA warning is not that VPNs are unsafe. It is that a self-hosted gateway is an internet-facing system that has to be patched, watched, and rebuilt when something goes wrong, and the credentials stored on it are what attackers want. If you run Ivanti Connect Secure, treat this as urgent. If you do not, use it as a reason to tighten your passwords, turn on two-step sign-in, and protect your own connection.

Want to go deeper? Read how CyberFence Breach Monitor works , the free CyberFence breach check tool , or the CyberFence password strength tool .