Ivanti VPN Attacks: Patching and Incident Checks Matter
Ivanti has disclosed active exploitation of Connect Secure appliances. For people using a work VPN, the response belongs with IT: a personal VPN cannot repair a compromised company gateway.
The short version
What you need to know
- Ivanti says CVE-2026-104935 has been exploited against a limited number of customers; this concerns Connect Secure appliances, not every VPN service.
- Administrators need the correct update for their deployment and incident checks where compromise is suspected. A clean integrity-check result is not conclusive.
- Staff should follow their employer's instructions rather than install an alternative VPN or bypass company access controls.
What the new disclosure says
Ivanti's 13 October advisory confirms active exploitation of CVE-2026-104935 in Connect Secure, the gateway organisations use for remote access. The vendor says an unauthenticated remote attacker could execute arbitrary commands and that a limited number of customers were affected at disclosure. It does not say every Connect Secure deployment has been compromised.
Volexity's investigation, published the same day, describes an attacker chaining authentication bypass, remote code execution and privilege escalation against an appliance running version 22.8R2.4, fully patched at the time of the incident. The researchers traced exploitation to 3 October. The authentication-bypass and remote-code-execution components are tracked together under CVE-2026-104935; Volexity says a fix for the separate privilege-escalation issue is still forthcoming.
Check the deployment, not just the headline
Ivanti lists resolved versions including 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5. These are not interchangeable upgrade choices: the advisory includes hardware and virtual-platform migration requirements for the 25.1.3.0 line. Administrators should use the vendor's current compatibility and upgrade instructions for their actual deployment.
The disclosure date is not the release date of every fix. Ivanti says 25.1.3.0 was released in July, 25.1.1.2 on 5 October and 22.8R2.5 on 12 October. Its advisory also says 22.7R2.14 and earlier are not affected by this particular vulnerability. That exception is not a general claim that an old appliance is secure or a reason to downgrade.
Why patching alone is not an incident investigation
Volexity observed credential theft, data exfiltration, network reconnaissance and log tampering. The attacker extracted credentials stored on the appliance and used a compromised service account to search Active Directory for sensitive information, including local administrator passwords and BitLocker recovery keys. The report does not establish that every secret sought was successfully recovered.
The researchers found no backdoor or web shell on the investigated device. They explain that in-memory changes and restored configuration data can escape the Integrity Checker Tool's file-modification checks. A clean result therefore cannot rule out this attack. Ivanti advises regular integrity checks and directs customers who suspect exploitation to its recovery guidance; Volexity recommends network and memory forensics. Security teams should assess exposed credentials and wider access as part of that response, not treat installing an update as proof that an earlier intrusion has been removed.
What employees can do now
If your employer uses Ivanti, ask IT whether the remote-access service is affected and follow its update, access and credential-reset instructions. Staff generally cannot fix the company gateway by updating a laptop alone. Use your organisation's established support channel to verify any unexpected message asking you to install a VPN update or enter credentials.
Do not bypass a temporary access restriction or replace the approved work VPN with a personal subscription. If IT suspends remote access while it investigates, use only an alternative that it explicitly approves.
Where a personal VPN does not help
A consumer VPN encrypts traffic between your device and its provider's server. It cannot patch an employer's Connect Secure appliance, remove an intruder from that appliance or recover credentials already stolen from it. This incident concerns the security of a remote-access gateway, not a failure of all VPN encryption.
Our guides below explain how a VPN connection works and what it does not hide. Those boundaries matter here: protecting one network connection is different from securing the server that grants access to a workplace.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.