Three previously unknown vulnerabilities in Ivanti Connect Secure VPN appliances have been under active exploitation for nearly two weeks, and federal cybersecurity officials are now pressing organizations to act immediately. The complication: Ivanti has only managed to patch one of the three flaws, leaving defenders to detect and contain a threat for which no complete fix yet exists.
A chain built for stealth
Security researchers at Volexity were the first to uncover the attack, tracing it to a threat actor the firm has labeled UTA0576. Beginning October 3rd, this group strung together three separate vulnerabilities to achieve unauthenticated, root-level code execution on fully patched Ivanti devices - a serious feat given that the targeted systems were, by definition, up to date. What made the intrusion especially difficult to catch was the attacker's decision to avoid installing any malware or web shell. Instead, the group re-exploited the device each time it needed to issue a command, executing everything in memory and tampering with logs to erase evidence of its presence. That approach allowed the intrusion to slip past Ivanti's Integrity Checker Tool, a defense mechanism specifically designed to flag unauthorized changes to the appliance.
A vulnerability disclosed late, patched later
Ivanti's own timeline raises uncomfortable questions. The company says it first discovered part of the vulnerability chain through its internal product security program and patched that portion in a July release. But the fix was not extended to other supported versions before attackers began exploiting the full chain in October - and Ivanti did not notify customers until October 13th, nearly two weeks after becoming aware that exploitation was underway. The flaw at the center of the advisory, CVE-2026-104935, is rated high severity and can let a remote, unauthenticated attacker execute arbitrary commands. Combined with the chain's privilege escalation component, it opens the door to credential theft and data exfiltration. The Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, confirming that Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are affected.
Why detection is harder than usual
CISA is urging organizations to go beyond simple patching and conduct network and memory forensics, echoing Volexity's warning that commands executed only in memory can leave little trace for standard integrity checks to find. This is a recurring theme in enterprise VPN security: appliances that sit at the network edge, handling authentication for remote access, are high-value targets precisely because a successful compromise can bypass the layered defenses protecting internal systems. When an attacker can authenticate without credentials and operate without leaving files behind, conventional detection tools built around static signatures or file integrity become far less effective.
A familiar target, a widening risk
Ivanti Connect Secure has a long history as a target for sophisticated intrusions, including ransomware operators, and this incident adds to a growing list - the company now has fifteen Connect Secure and Pulse Connect Secure vulnerabilities on CISA's exploited list. Researchers caution that the pattern tends to repeat: narrowly targeted exploitation gives way to mass, indiscriminate attacks once technical details circulate more widely. According to threat intelligence specialists who examined the flaw, the underlying bug is strikingly simple to trigger - a single crafted request header is enough to bypass authentication. Organizations running affected appliances are advised to patch without delay, inspect logs for suspicious inbound requests, and treat the absence of a fix for the third vulnerability as a reason for heightened, not relaxed, vigilance.