What happened
Volexity observed exploitation beginning on October 3, 2026. Investigators found a previously undocumented actor chaining an authentication bypass, remote code execution and a separate privilege escalation against an Ivanti Connect Secure appliance that was running version 22.8R2.4 and was fully patched at the time. The complete chain produced unauthenticated root-level command execution.
Ivanti disclosed CVE-2026-104935 and released fixes on October 13, 2026. Reporting identified Ivanti Connect Secure 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier as affected by CVE-2026-104935. Ivanti fixed the authentication-bypass and remote-code-execution components in Connect Secure 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. The separate privilege-escalation component remained unpatched at disclosure.
The actor stole domain credentials, collected limited Active Directory metadata, searched for LAPS passwords and BitLocker recovery keys, performed password spraying and used a custom Kerberos tool. Investigators also described network reconnaissance, appliance-configuration collection, authentication-log parsing and attempts to capture credentials from network traffic. No persistent backdoor or web shell was found; the exploit chain was reportedly reused to pass commands.
Reporting citing the investigation says evidence was deleted from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. The cited sources did not publish a complete command transcript, malware hash, IP address or domain indicator for the activity. Attribution posture: Volexity tracks the operator as UTA0576 and assesses criminal motivation with low confidence; no public identity has been established.
Why this matters now
The affected product sits at a privileged network boundary and routinely handles authentication material, remote-user traffic and access to internal services. Root-level execution on that device can expose credentials and reconnaissance data while providing a position for lateral movement. The appliance’s placement makes a limited victim count less reassuring than it would be for an ordinary endpoint.
The compromised appliance was fully patched when exploitation began. Ivanti’s update closes the disclosed unauthenticated entry components, but the separate privilege-escalation issue remained without a fix at disclosure. Security leaders must therefore track branch-specific updates and keep residual exploit-chain risk visible rather than closing the case when one CVE ticket turns green.
The actor reportedly restored in-memory changes, removed log evidence and did not need a persistent web shell. Those techniques weaken appliance-only integrity checks and conventional web-shell hunts. Organisations need external network, identity and centralised logging to assess whether credentials or internal resources were touched.
The decision for security leaders
Make patch deployment and compromise response parallel workstreams. Network engineering should move affected branches to fixed releases, while incident response preserves evidence and assesses activity from the appliance into identity systems and internal networks. Waiting for perfect forensics before patching leaves the entry path open.
Assume credentials stored on, configured in or transmitted through a suspected appliance require scoped containment. Prioritise privileged domain accounts, service accounts, administrative sessions, LAPS access and BitLocker recovery-key exposure. Rotation scope should follow evidence but must not depend on finding a web shell.
Record the unresolved privilege-escalation component as an explicit exception with an owner, compensating controls and review trigger. Where root compromise cannot be excluded, leadership should consider rebuild or replacement rather than accepting an upgraded appliance as proof of trustworthiness.
Evidence of closure
- Branch-specific inventory showing every affected appliance upgraded or isolated.
- Preserved forensic package containing memory, network and central-log evidence.
- Completed credential-rotation record scoped to each exposed appliance.
- Approved rebuild or retention decision for every potentially compromised appliance.
The Security.io assessment
This case demonstrates why current patch status and compromise status are different assertions. The appliance met the available patch baseline when the attacker arrived, and the disclosed update addresses only part of the chain. A vulnerability ticket cannot represent the full incident state.
The absence of persistence is not evidence of absence. Re-executing the chain for commands, restoring memory changes and deleting logs can reduce durable appliance artefacts while credentials and directory knowledge remain useful to the attacker. External telemetry and credential containment therefore carry more weight than a clean appliance scan.
Confidence is medium because this edition’s source ledger contains accountable reporting rather than the original Ivanti and Volexity documents. The core facts are consistently reported, but branch guidance and the status of the remaining flaw can change quickly. Closure should remain conditional on vendor updates and forensic evidence.
Questions for the morning meeting
- Which Ivanti Connect Secure appliances were internet-facing during the reported exploitation window?
- Can the organisation preserve memory, network and central logs before upgrading or rebuilding appliances?
- Which domain or service credentials were stored on or traversed each appliance?
- Does closure require appliance replacement because a root-level compromise cannot be disproved?