Ivanti Connect Secure Zero-Day: Patch Your VPN Before Attackers Get Root

The Ivanti Connect Secure zero-day is the one to patch this week: attackers are already using it to run commands on company VPN gateways without a password. Ivanti disclosed the bug, tracked as CVE-2026-104935, on October 13, and fixed builds are available now.

If you run Connect Secure at work, treat this as an emergency update. If you only use a VPN to connect to an employer, forward this to your IT team.

Here are the quick facts:

• The flaw is an authentication bypass with a CVSS score of 8.6, per Rapid7.
• Disclosed October 13, 2026, and already on CISA’s known-exploited list.
• Affected: Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier.
• Fixed in 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
• A related privilege escalation bug is still unpatched.

Those five lines are the whole story for a skimmer. The rest of this post explains what to check after you update.

What the Ivanti Connect Secure zero-day lets attackers do

Connect Secure is a VPN appliance that sits on the edge of a company network. A bug that skips login there is about as bad as it gets, because the device is reachable from the internet by design.

Ivanti says an unauthenticated attacker can run arbitrary commands remotely. No user has to click anything, and the attack is low-effort. That combination is why Ivanti and CISA moved so fast.

It was a true zero-day. Ivanti confirmed attacks on a limited number of customers before the advisory went out.

The attackers aren’t guessing passwords or phishing staff. They talk straight to the appliance and get it to treat them as a trusted user, which is why strong passwords and multi-factor login don’t help here. Once they can run commands, they can reach whatever the VPN reaches inside the network, from file servers to internal apps.

Which Connect Secure versions need the fix

Ivanti’s advisory splits the fix across three code lines. Find your current build in the admin console, then match it below.

Part of this flaw was actually fixed back in the July 2026 release, 25.1.3.0. Rapid7 notes the attacks landed while Ivanti was still backporting that fix to older supported lines.

How the attack worked, and why patching isn’t enough

Volexity, the firm that spotted the activity, says a group it tracks as UTA0576 chained this bug with other flaws to get root-level code execution. BleepingComputer reports that Volexity saw exploitation from at least October 3, while security firm Defused saw first signs on October 1.

The worrying part is how quiet it was. The attacker reportedly dropped no malware and no web shell. Instead, it re-exploited the device for each command, tampered with logs, and slipped past Ivanti’s own Integrity Checker Tool.

So a clean scan is not proof of a clean box. Updating closes the door, but anyone who got in during the first two weeks of October may still have what they took.

One more catch: the privilege escalation bug in the chain is still waiting on a patch. Ivanti says it is working on it, and there is no CVE for it yet in the sources I found.

What to do today if you run Connect Secure

Do these in order. The first step is the most urgent, and the rest help you find out whether you were already hit.

1. Upgrade to a fixed build from the table, outside your normal patch window.
2. Run the Integrity Checker Tool, but don’t treat a pass as final.
3. Check Volexity’s published indicators on its GitHub page, since Ivanti says reliable ones aren’t available yet.
4. Review VPN logs from October 1 onward for odd logins or commands.
5. If you suspect a compromise, follow Ivanti’s recovery steps and rotate credentials that passed through the appliance.

Rotating credentials is the step people skip. If the attacker had root, every password and token on that gateway is suspect.

Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances. Some may be honeypots or already protected, but plenty are probably not.

Frequently Asked Questions

Is the Ivanti Connect Secure zero-day patched?

Yes, for the main bug. Ivanti shipped fixed builds on October 13. A related privilege escalation flaw used in the same attack chain is still unpatched.

Does this affect regular home users?

Not directly. Connect Secure is a business VPN gateway, not a consumer VPN app. Your risk depends on whether your employer runs an unpatched one.

How do I know if my Connect Secure appliance was hacked?

It’s hard to tell. The attackers reportedly evaded the Integrity Checker Tool and altered logs. Check Volexity’s indicators, review logs back to October 1, and bring in a response team if anything looks off.

Is this the first Ivanti VPN zero-day?

No. Per Rapid7, Connect Secure was also hit by zero-days in 2024 and 2025, including CVE-2025-0282.

Edge devices like this are a favorite target. We saw the same pattern with the Cisco Secure Email Gateway zero-day, and Microsoft also patched an exploited bug this month, covered in our Windows 11 KB5127648 guide.

My take: patch first, then assume nothing

Update today, and then hunt as if you were breached. A quiet, log-wiping attacker with two weeks of head start is exactly the situation where “we patched, so we’re fine” goes wrong. If you can’t verify, rebuilding the appliance is cheaper than guessing.