Ivanti VPN Zero-Day: Why a Clean Scan Isn't Proof

By Felipe Isaza, FUNCSHUN | Companion to CyberScope Weekly Vol 69

Most security checks tell you whether something changed. This attack was built so nothing looked changed.

What happened

On Oct 13, 2026, Ivanti disclosed CVE-2026-104935, a zero-day in Ivanti Connect Secure, its remote-access VPN. It's an authentication bypass that lets a remote attacker with no login run arbitrary commands on the appliance. Ivanti said it was aware of "limited exploitation in the wild" and told customers running an affected version to "act immediately." The CVE record rates it 8.6 (High). Affected versions are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Fixes are in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.

CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Oct 16 to act. Its alert says attackers are using the flaw for credential theft and data exfiltration.

Volexity, which found the attacks, says a group it tracks as UTA0576 started exploiting it on Oct 3 and broke into a Connect Secure appliance that was fully patched at the time. Once in, the attackers pulled domain credentials stored on the appliance, searched Active Directory for LAPS local admin passwords and BitLocker recovery keys, ran password spraying, captured LDAP traffic and deleted their own log entries. They left no backdoor or web shell behind. Volexity assessed with high confidence that the activity was preparation for moving deeper into the network. Threat intel firm Defused told BleepingComputer it saw the first signs of exploitation on Oct 1.

One more detail matters. The attack chained three flaws. CVE-2026-104935 covers two of them. The third, a privilege escalation to root (since assigned CVE-2026-111357), wasn't fixed in the Oct 13 release. Ivanti said that fix would come in a future release "in the coming weeks."

Why a clean integrity scan isn't proof

Ivanti's usual advice is to run its Integrity Checker Tool. This time, CISA warns that the tool "may not detect evidence of exploitation" because the attacker's commands run in memory. Volexity explains why: the attackers patched code only in memory, put the configuration back the way it was and removed log entries. The checker looks for changes on disk, and there were none to find.

CISA's guidance is that confirming whether you were hit takes network and memory forensics. A green result from the checker doesn't settle it.

Why this matters if you handle CUI

CMMC Phase 2 was suspended on Jul 13, 2026. Your obligations weren't. DoD's suspension memo says the DFARS 252.204-7012 requirements remain in effect and that it will enforce NIST SP 800-171 Rev 2. If your contracts carry that clause, you already must:

• Implement NIST SP 800-171 on systems that process, store or transmit covered defense information.
• Report cyber incidents to DoD within 72 hours of discovery.
• Preserve images of affected systems, plus relevant monitoring and packet capture data, for at least 90 days after you submit the incident report.

A VPN is the front door to your CUI environment. In NIST SP 800-171 Rev 2, it falls under 3.1.12 ("Monitor and control remote access sessions") and 3.14.1 ("Identify, report, and correct system flaws in a timely manner"). And in this attack, the appliance held the keys to Active Directory. If your SPRS self-assessment says those controls are met, you should be able to show the patch date, the version and what you checked after patching.

What to do this week

1. Find out if you run Ivanti Connect Secure. Ask your IT team or MSP directly. Note the version on every appliance, physical or virtual.
2. Patch now. Upgrade to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1, depending on your code line. Version 22.8 reaches end of life on Jan 31, 2027, so plan the move to 25.x.
3. Don't trust a clean integrity scan. Run it, but treat a pass as one data point, not an answer.
4. Hunt for compromise back to Oct 1. Volexity advises watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, and checking /tmp/ on the appliance. Look for lateral movement that starts from the VPN.
5. If anything looks off, follow CISA's recovery steps: back up the config, factory reset (or rebuild a virtual instance), upgrade, then restore the config.
6. Rotate credentials tied to the appliance. CISA says to reset passwords for all accounts, including domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials. Include the VPN's Active Directory service account.
7. Review remote access. Who can reach the VPN, which accounts are still active, and whether you'd see an unusual session. Remember the privilege escalation flaw may not be fixed yet, so watch Ivanti's advisory for the next release.
8. Save evidence: version screenshots, patch dates, scan results and what you hunted for, filed with your SSP.
9. Confirm your incident plan names who reports to DoD within 72 hours, and who preserves images and monitoring data for 90 days, if you find signs you were hit.

The bottom line

Patching closes the door. It doesn't tell you whether someone already walked through it. This week, patch, check past the scan, and rotate what the VPN could reach.

Not sure whether your remote access would hold up to a prime or an assessor? Book a Cyber Risk Strategy Call: https://start.funcshun.com

Felipe Isaza helps defense contractors protect CUI and stay CMMC-ready. Get threats like these every week in CyberScope Weekly.

---

Sources

• CISA, "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure" (Oct 13, 2026): https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
• CISA, Known Exploited Vulnerabilities Catalog, CVE-2026-104935 (added Oct 13, 2026; due Oct 16, 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Ivanti, "October 2026 Security Update" (Oct 13, 2026): https://www.ivanti.com/blog/october-2026-security-update
• Ivanti, Security Advisory Ivanti Connect Secure (CVE-2026-104935): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• CVE Record, CVE-2026-104935: https://www.cve.org/CVERecord?id=CVE-2026-104935
• Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" (Oct 13, 2026): https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
• BleepingComputer, "Ivanti warns of Connect Secure zero-day exploited in attacks" (Oct 13, 2026): https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
• SecurityWeek, "Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN" (Oct 13, 2026): https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/
• Department of War, Under Secretary of War (A&S) memo 26-P-1023, "Implementing Department of War Chief Information Officer's Suspension of the Advancement to CMMC Phase 2 Requirements" (Jul 13, 2026): https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024): https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
• DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements (Nov 2023): https://www.acquisition.gov/dfars/252.204-7019-notice-nist-sp-800-171-dod-assessment-requirements.
• NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final