Ivanti Connect Secure Zero-Day Chain: What Happened and What IT Teams Should Do Now

Ivanti's VPN products have been repeat targets for exploitation, which makes this disclosure important for any organization that exposes a gateway to the internet.

Below we summarize the confirmed facts from three sources, flag where they differ and give a practical checklist.

What Happened

On October 13, 2026, Ivanti told customers that attackers were exploiting a zero-day in Connect Secure, its SSL VPN gateway. Security firm Volexity found the activity while investigating a customer incident and published its technical analysis the same day.

According to BleepingComputer and SecurityWeek, the flaw is tracked as CVE-2026-104935 and combines an authentication bypass with remote code execution. Volexity says the attackers chained it with a third flaw, a privilege escalation bug, to gain root-level code execution even on fully patched devices, as described in its research post.

Timeline and Scope

Volexity dates the earliest exploitation it observed to October 3, 2026, and began investigating on October 5. Ivanti disclosed the issue and released fixes for the first two flaws on October 13. Ivanti described the in-the-wild exploitation as limited.

• October 3, 2026: earliest exploitation observed by Volexity.
• October 5, 2026: Volexity begins its investigation.
• October 13, 2026: Ivanti publishes patches for CVE-2026-104935 and Volexity publishes its analysis.

BleepingComputer reports that Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances, though it is unclear how many are honeypots or already protected. Exposure is therefore real but not precisely measured.

What the Attackers Did

Volexity tracks the actor as UTA0576 and assesses with low confidence that it is criminally motivated rather than focused on espionage. The activity centered on credential theft and reconnaissance rather than malware installation, and no web shell or backdoor was found on the appliance.

• Stole domain credentials stored on the appliance and queried Active Directory metadata.
• Searched for LAPS passwords and BitLocker recovery keys.
• Attempted password spraying and Kerberos-based attacks.
• Altered logs and removed its own scripts, which can defeat the Integrity Checker Tool.

Volexity also assesses with medium confidence that the actor uses large language models to help with exploit development and post-exploitation work, per SecurityWeek's summary.

Patch Status and Affected Versions

Fixes exist for the authentication bypass and remote code execution flaws, but the privilege escalation flaw in the chain was still unpatched as of October 13, 2026. Ivanti plans a fix in a later release, so patching alone does not fully close the risk yet.

SecurityWeek lists fixed builds as 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1, while Volexity describes affected releases as 22.8R2.4 and earlier along with the 25.1 branch. Version details differ slightly between sources, so use the official Ivanti advisory as the authority for your build.

Why It Matters for B2B SaaS Buyers and IT Teams

A compromised VPN gateway sits at the edge of the network, holds credentials and sees internal traffic. Attackers who control it can pivot into directory services, cloud consoles and SaaS admin accounts, so one appliance can become a path into many systems.

The case also shows that "patched" and "safe" are different. When an exploit chain includes an unpatched component, and the vendor integrity tool can be evaded, teams need independent detection such as network logging, memory forensics and identity monitoring.

What to Do Now: A Checklist

Treat any internet-facing Connect Secure appliance as potentially affected until proven otherwise. Upgrade to a fixed build, hunt for the published indicators, and reduce what an attacker could steal if the device was already compromised.

• Confirm your Connect Secure version and upgrade to a fixed release per Ivanti's advisory.
• Review web logs for unusual volumes of requests to the welcome.cgi endpoint with mismatched X-DSCGI-PATH headers, as Volexity advises.
• Check /tmp for unexpected scripts or JSON output files and look for a hidden /data/.icscap/ directory.
• Do not rely only on the Integrity Checker Tool; run network and memory forensics on suspect devices.
• If compromise is suspected, rotate domain and service credentials stored on or reachable from the appliance, plus LAPS passwords and BitLocker keys.
• Restrict management interfaces, enforce phishing-resistant MFA for admins and forward VPN logs to a SIEM.

Related SaaSPodium Resources

Remote access, VPN and detection tooling are the categories most affected by this incident. Use them to compare alternatives and to strengthen monitoring around your network edge, using the same criteria of patch history, logging quality and management isolation described above.

If you are reassessing remote access, compare options in the VPN Software and Remote Access Software categories. Detection and response tooling is listed under Endpoint Detection and Response Software and Vulnerability Management Software.

For another recent patching story, see our GitLab critical patch coverage.

Frequently Asked Questions

Is the Ivanti Connect Secure zero-day patched?
Partly. Ivanti released fixes on October 13, 2026 for the authentication bypass and remote code execution flaws tracked as CVE-2026-104935. The privilege escalation flaw in the same chain was reported as unpatched, with a fix planned later.

Should we replace Ivanti Connect Secure with another VPN?
That depends on your risk tolerance and architecture. Patch and investigate first, then evaluate alternatives such as other VPN or zero trust access products using criteria like patch history, logging, and management isolation.

How can we tell whether our Connect Secure appliance was compromised?
Check logs for abnormal welcome.cgi requests with mismatched X-DSCGI-PATH headers, look for the artifacts Volexity lists, and perform memory and network forensics, because the Integrity Checker Tool may not detect this compromise.