Ivanti patches two Connect Secure flaws after exploit

Volexity said it found the attack on one customer’s Ivanti Connect Secure appliance. The firm said the device was fully patched and running version 22.8R2.4, and that the attacker it tracks as UTA0576 began activity on 3 October.

Volexity said the attack used three flaws together. It described the first two as an authentication bypass and a remote code execution issue grouped as CVE-2026-104935, which let code run as the appliance’s cgi-server user, and said a third privilege-escalation flaw raised that access to root.

Ivanti said its CVE record showed Connect Secure versions before 25.1.3.0 were affected, while 22.7R2.14 or earlier was not affected and 22.8R2.5, 25.1.3.0 and 25.1.3.1 were listed as unaffected. Ivanti said it had fixed two of the flaws and was working on a future release for the third.

Ivanti told customers to upgrade and use its Integrity Checker Tool. Volexity said that tool would not catch this chain because the exploit changed library code only in memory and restored the configuration data it altered.

In the incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. Volexity said no backdoor or web shell was left behind, and that the attacker reran the full chain for each command. It assessed with low confidence that UTA0576 was criminal rather than espionage, and neither company said how many customers were affected.