Start with the sentence that should not be possible: the box was patched.

Patched, on paper

The compromised appliance ran Ivanti Connect Secure 22.8R2.4, the latest available release on that branch when Volexity investigated. It was fully patched for its branch, but remained vulnerable to a flaw Ivanti had already addressed in a newer release line: Ivanti says it identified part of the vulnerability through its own product security programme and patched it in the July 2026 release of 25.1.3.0. Exploitation occurred while the company was still backporting the fix to the remaining supported versions. Being current on one branch was therefore not enough; operators needed to check the specific CVE and the fixed-version guidance.

That distinction matters more than the zero-day label. A device can be current on its branch and still carry a flaw the vendor has already fixed elsewhere in the product line, because "patched" describes the branch you are on, not the state of the code across the product line.

Three weaknesses, chained

Volexity reconstructed a three-stage chain: a URL-versus-header routing flaw allowed unauthenticated requests to reach protected scripts; a file-write race allowed attacker-supplied code to execute before an invalid upload was deleted; and a separate privilege-escalation weakness enabled root-level execution. The attacker repeatedly used the exploit requests themselves to run commands and return results. Volexity found no separately deployed web shell or persistent backdoor on the appliance, although that does not rule out other activity elsewhere in the network. Its suggestion of LLM-assisted tooling remains a medium-confidence assessment.

The mismatch has a name worth searching logs for: requests to the public login page carrying an X-DSCGI-PATH header that points somewhere else. The URL decides whether a request is allowed; the header decides where it goes.

What the attacker actually wanted

After obtaining root access, UTA0576 extracted credentials and appliance configuration data, queried Active Directory through a compromised service account, and searched for LAPS administrator passwords, BitLocker recovery information and password-bearing attributes. Volexity also observed password spraying, LDAP packet-capture analysis and exfiltration activity. The distinction matters for anyone assessing their own exposure: the stored credentials and configuration data were demonstrably taken, while the LAPS passwords, BitLocker keys and password-bearing attributes were what the actor's tooling searched for — whether every search returned data is a separate question.

A VPN appliance is a rational place to steal those things. It sits where remote users authenticate, and it can see traffic other systems cannot. Whoever holds its credentials does not need to break in a second time.

The patch does not answer the only question that matters

Apply Ivanti's October 13 security updates immediately on affected appliances. CISA lists October 16 as the remediation date for covered federal agencies. Then investigate the period beginning October 3, rotate potentially exposed domain, service-account, LAPS and BitLocker credentials, and review authentication and network activity for lateral movement. Forensic examination, including available logs and memory artifacts, is necessary because the integrity checker does not reliably identify this chain. The pending privilege-escalation fix means the patched system should not yet be described as fully remediated against every component of the original chain.

Two qualifications belong beside that sequence. CISA's catalog entry does not only set the 16 October date: it also invokes the agency's forensic triage requirements, so for covered agencies, installing the patch alone may not satisfy every applicable federal instruction. And the forensic step has limits of its own — memory analysis is valuable, but evidence held in memory does not survive every reboot, and artifacts can be overwritten by later activity.

There is a second gap. The privilege escalation component of the chain is still awaiting its fix, promised in a later release. Patching this week therefore reduces the chain's reach without retiring every part of it, and the monitoring advice in Volexity's report — watch for requests to the login page carrying a routing header that does not match the URL, and check the appliance's temporary directories — is worth acting on rather than filing. One more branch note from the MS-ISAC advisory: Ivanti recommends that customers still on the 22.8 line move to 25.1.1.2 or later, because 22.8 reaches end of life on 31 January 2027.

Treat the appliance as a suspect witness rather than a cleared one. A clean patch report is the beginning of that work, not the end of it.

Sources

  1. [1] Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days", 13 October 2026 — the primary forensic source: the three-flaw chain, post-exploitation targeting, log deletion, the integrity checker's blind spot, the pending privilege-escalation fix and monitoring guidance; paraphrasedRead source
  2. [2] Ivanti — security advisory for CVE-2026-104935 (affected and fixed versions; the advisory link is corroborated by the MS-ISAC and NVD records)Read source
  3. [3] National Vulnerability Database — CVE-2026-104935 record (CVSS 8.6, and the CISA KEV data reproduced there)Read source
  4. [4] CISA — Known Exploited Vulnerabilities catalog (CVE-2026-104935 added 13 October 2026; remediation due 16 October 2026 for covered federal agencies; forensic triage required)Read source
  5. [5] MS-ISAC advisory 2026-115, 13 October 2026 — affected and fixed versions, and Ivanti's recommendation that customers on the 22.8 line move to 25.1.1.2 or laterRead source
  6. [6] BankInfoSecurity, "Ivanti VPN Zero-Day Exploited in Active Attacks", 13 October 2026 — Ivanti's internal discovery and July release, backport status, and the watchTowr comment on the catalog count; paraphrasedRead source
  7. [7] Cyber Daily, "Patch now! Hackers already targeting newly disclosed Ivanti Connect Secure zero-day", October 2026 — affected and fixed version lists and the CISA statement; paraphrasedRead source