Enterprise VPN appliances are supposed to guard the edge of the network. This week, one of the most widely used of them became the way in.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately update Ivanti Connect Secure after disclosure of an actively exploited zero-day, CVE-2026-104935. The flaw is an authentication bypass rated 8.6 out of 10 that lets a remote, unauthenticated attacker execute arbitrary commands. CISA says actors are already using it for credential theft and data exfiltration, and it added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Federal civilian agencies must apply the fix by October 16.
The affected releases are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Ivanti has released fixed builds including 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, while versions 22.7.x and below are reported unaffected. Version 22.8 itself reaches end of life on January 31, 2027, a detail that matters for teams weighing an upgrade against a migration.
What elevates this beyond a routine patch alert is how the flaw has been used. Volexity reports first observing exploitation in early October, with a previously undocumented actor it tracks as UTA0576 chaining the bypass with a privilege-escalation flaw to gain unauthenticated root-level access, even on a fully patched 22.8R2.4 appliance at the time. After entry, the actor extracted credentials stored on the appliance, gathered limited Active Directory metadata, and searched for administrator passwords and BitLocker recovery keys, including Local Administrator Password Solution passwords.
The tradecraft was built to be hard to see. According to Volexity, the actor deployed no persistent malware or web shell, re-exploiting the device for each command, running commands in memory, and tampering with logs. That is why CISA warns that Ivanti's Integrity Checker Tool may not detect this exploitation, and why it says determining compromise will require network and memory forensics rather than a quick appliance scan.
Broader scanning is already under way. Previdian said its honeypots had logged 105 exploitation attempts as of October 14, from 50 unique IP addresses. Researchers at watchTowr note the bypass can be triggered with a single specially crafted request header, and they advise hunting for inbound requests carrying that header as a starting indicator. That simplicity is the risk: a flaw that needs no credentials and little effort tends to move quickly from targeted intrusions to mass exploitation.
For defenders, patching alone may not be enough if an appliance was already hit. CISA's recovery guidance calls for backing up the configuration, factory-resetting the appliance — or rebuilding the virtual instance for cloud and virtual deployments — upgrading to the latest version, and then restoring the configuration. It also calls for resetting passwords for domain, administrator and local accounts, revoking and reissuing stored certificates, and resetting stored API keys and license server credentials.
The practical takeaway for enterprise IT teams is blunt. Inventory every Connect Secure deployment today, patch on an emergency timeline, and treat any unpatched, internet-facing appliance as potentially compromised until forensics say otherwise. Edge devices hold the keys to remote access; when one fails open, the response has to assume attackers noticed first.