The usual advice after a VPN zero-day is to install the update and move on. The Ivanti Connect Secure story from this week breaks that rule, because the update only closes two of the three holes the attackers used. SecurityWeek reports that Ivanti has warned of exploitation of CVE-2026-104935 in Connect Secure appliances, affecting a limited number of customers.
Three bugs, two fixes
Volexity found the activity while investigating an incident at one of its customers and traces it to 3 October. The actor, a previously unseen group it tracks as UTA0576, chained an authentication bypass and a remote code execution flaw (both under CVE-2026-104935) with a privilege escalation to reach root. The patched releases are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The escalation bug has no fix yet; Ivanti says it will arrive "over the coming weeks". In practice that means a fully patched appliance can still be taken to root by someone who finds another way to get code running on it.
Volexity did not find a web shell or a backdoor on the device. What the attackers did was quieter: they took domain credentials stored on the appliance, pulled limited Active Directory metadata, ran a custom tool that looks for LAPS passwords and BitLocker recovery keys, sprayed passwords and tested them with a Kerberos tool, and read authentication logs to learn valid usernames. Volexity believes it was preparation for lateral movement, and that the intrusion was caught before the real aim became clear.
The detail worth underlining
Volexity assesses, with medium confidence, that the group uses large language models for exploit development and for post-exploitation work. Treat that as an assessment rather than a proven fact, and note that it comes with low confidence that the actor is criminal rather than a state. Still, it fits the pattern we keep seeing: chains that used to take months to assemble are appearing days after a product ships.
What to do while the third fix is pending
- Upgrade to one of the fixed versions anyway. It removes two links.
- Rotate every credential the appliance holds: the service account that binds to Active Directory, any LDAP or RADIUS secrets, certificates. Assume they were readable.
- Check where those credentials are used. Alert on the VPN service account authenticating from anywhere other than the appliance, and on queries for LAPS attributes or BitLocker recovery objects from non-admin sources.
- Pull the appliance's authentication logs from 3 October onward and look for unusual username enumeration or bursts of failures.
- Reduce what the appliance can reach. If a compromised VPN gateway can talk to every domain controller and file server, the third bug costs you more than it should.
- Subscribe to Ivanti's advisory and set a calendar reminder to review it every few days until the escalation fix lands.
Our broader view is that edge appliances need to be run as untrusted-by-default parts of the estate. If you want help with that design, email sales@halfteck.com.