The Cybersecurity and Infrastructure Security Agency (CISA) told organizations Tuesday to patch Ivanti Connect Secure remote-access gateways immediately after attackers began exploiting a previously unknown flaw, and gave federal civilian agencies until Oct. 16 to act. The case matters well beyond government: researchers who found the intrusion say it hit a device that was running the latest software, and the vendor’s own check for tampering may not detect it.

What Happened

In an alert published Oct. 13, CISA said the flaw, tracked as CVE-2026-104935, is an authentication bypass that lets a remote attacker with no account run commands on the appliance, and that threat actors are using it for credential theft and data exfiltration. Connect Secure is a VPN product: the gateway employees log in through to reach internal networks.

CISA added the flaw to its Known Exploited Vulnerabilities catalog, a list of bugs the agency has evidence are being used in real attacks. The catalog entry sets a due date of Oct. 16 under Binding Operational Directive 26-04, which applies to federal civilian agencies, and points them to CISA’s forensic triage requirements. A Microsoft Windows Shell flaw was added the same day with the same deadline.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. SecurityWeek reported that fixed versions are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. CISA noted that the 22.8 line reaches end of life Jan. 31, 2027.

Ivanti said in an update that it is aware of limited exploitation and is working directly with affected organizations. CyberScoop reported that Ivanti’s advisory describes a “limited number of customers” as compromised, and that the company found part of the defect in internal checks in June but judged it did not warrant an emergency release.

What the Researchers Found

The attack was documented by Volexity, a security company, in research published the same day. Volexity said it began investigating Oct. 5 at a monitoring customer and traced the intrusion to an appliance running 22.8R2.4, then the latest release, which the attacker had exploited repeatedly from Oct. 3.

According to Volexity, the attacker chained three previously unknown flaws: two that together make up CVE-2026-104935, and a third that raises access to root, the highest level of control. Ivanti told CyberScoop it is still developing an update for that remaining flaw; Volexity said the fix is expected in the coming weeks.

Volexity says the attacker took domain credentials stored on the device, searched the corporate directory for local administrator passwords and BitLocker disk-encryption recovery keys, and tried password-guessing and Kerberoasting, a technique for cracking service-account passwords. It left no web shell or malware, ran its code in memory and deleted log entries.

Volexity tracks the actor as UTA0576, a group it had not seen before. It assessed with low confidence that the motive is criminal rather than espionage, and with medium confidence that the actor used large language models to build its exploits. Those are the company’s assessments; it has not named who is behind the group.

Why It Matters

For boards and executives, the lesson is that “patched” and “safe” are not the same for internet-facing gateways. CISA says Ivanti’s Integrity Checker Tool may miss this compromise because the commands run in memory, and that network and memory forensics are needed. For suspected victims it recommends a factory reset or rebuild, then resetting every domain, administrator and local password and reissuing certificates, API keys and license-server credentials.

The cleanup is costly, and the stolen material reaches far past the VPN itself. Directory credentials and disk-encryption keys can open the rest of the network.

Context

Exposure is broad. BleepingComputer reported that the Shadowserver Foundation sees more than 5,500 Connect Secure instances online and that the security firm Defused saw first signs of exploitation Oct. 1. The Record said this is the sixth Ivanti flaw added to CISA’s catalog in 2026; CyberScoop counted 36 since late 2021.

What to Watch

Ivanti still has to ship a fix for the privilege-escalation flaw. Yordan Ganchev of the security firm watchTowr told CyberScoop that “widespread, indiscriminate exploitation is inevitable” as attackers study the patch. The number of compromised organizations remains undisclosed, and agencies’ Oct. 16 deadline will show how quickly the government’s own exposed devices are checked and fixed.