Editorial analysis · Primary sources
Ivanti Connect Secure zero-day chain turns gateway compromise into an identity crisis
Confirmed exploitation of an Ivanti Connect Secure zero-day enabled credential theft, data exfiltration and access to enterprise recovery secrets; patching is urgent but does not establish that a device is clean.
Confirmed timeline
Volexity observed exploitation beginning on 3 October 2026 against an appliance that was fully patched at the time and began investigating on 5 October. On 13 October, Ivanti coordinated a fix and CISA disclosed active exploitation of CVE-2026-104935, an authentication bypass enabling unauthenticated command execution [1][2]. The CVE record identifies fixed releases 25.1.3.0, 25.1.3.1 and 22.8R2.5; 22.7R2.14 and earlier are listed as unaffected [3].
Observed intrusion
This is a confirmed intrusion chain, not only a vulnerability advisory. Volexity found the bypass and remote-code-execution flaw chained with a separate local privilege-escalation issue. The actor obtained domain credentials, Active Directory metadata, LAPS passwords, BitLocker recovery keys and appliance authentication data, then performed password spraying and network reconnaissance [2]. The public record does not establish how many organizations were compromised.
Mission and exposure
An internet-facing access gateway is a trust anchor. Compromise can move from remote access into enterprise identity, endpoint administration and recovery processes, creating risk to continuity even after the appliance is patched. Owners should identify exposed versions, review activity from at least 3 October and assess downstream use of directory bind accounts, privileged sessions, LAPS and recovery keys.
Response priorities
Upgrade immediately to a fixed release, but do not treat patching as containment. Preserve evidence; isolate or rebuild suspicious appliances; revoke sessions and tokens; rotate appliance, administrative, LDAP bind and other exposed credentials; and reassess LAPS and BitLocker secrets according to evidence. Use independent network, identity, endpoint and memory telemetry because Volexity observed log deletion and warned that the appliance integrity checker may not reliably identify compromise [2].
Governance and unknowns
Assign executive ownership across security, identity, infrastructure, continuity and legal teams. Require independent logging for perimeter appliances, tested evidence-collection procedures and lifecycle deadlines for unsupported releases. Attribution, total victim count, final objectives and the prevalence of the full chain remain unverified. Confidence is high for exploitation and observed post-compromise behavior, but limited for broader scope.
Sources
- CISA, CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, 13 October 2026 (accessed 14 October 2026)
- Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, 13 October 2026 (accessed 14 October 2026)
- CVE Program, CVE-2026-104935 record, published and updated 13 October 2026 (accessed 14 October 2026)
- HKCERT, Ivanti Connect Secure Remote Code Execution Vulnerability, 14 October 2026 (accessed 14 October 2026)