Ivanti's Zero-Day Chain Took Root on a Fully Patched VPN. Its Own Integrity Checker Said Nothing

Ivanti disclosed CVE-2026-104935 on October 13 and shipped fixes the same day. Volexity, which found the exploitation, published its account of the intrusion within hours of it. Read together, the two documents describe something worse than another high-severity VPN bug: an appliance running the newest build Ivanti offered, taken to root, by an actor whose presence Ivanti's own Integrity Checker Tool did not report.

What Ivanti fixed, and what it did not

CVE-2026-104935 covers two flaws in Ivanti Connect Secure — an authentication bypass and a remote code execution issue — carrying a combined CVSS v3.0 score of 8.6. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Ivanti says exploitation preceded disclosure and affected "a limited number of customers."

The chain is what matters, and the CVE does not cover all of it. Volexity describes a third flaw, a privilege escalation, used in the same sequence to reach root. That one is not fixed. Ivanti plans to address it "in the coming weeks."

So Tuesday's patch closes the front door and leaves the stairs. The distinction is practical rather than academic: upgrading removes the unauthenticated entry point, which is most of the exposure, but the appliance still carries a known route from code execution to root for anyone who arrives by another path.

Three assurances failed at once

The appliance Volexity examined was running 22.8R2.4, Build 19097 — the latest version available at the time it was compromised. Patch currency was not the gap.

Neither was there anything on disk to find. Volexity reports no web shell and no backdoor: the actor sent commands and collected results through the exploit channel itself. Persistence was simply re-exploitation, which against an internet-facing appliance costs nothing.

And the tool Ivanti supplies for precisely this question came back quiet. The Integrity Checker Tool did not detect the compromise. The actor also removed entries from debug and audit logs and restored in-memory state it had altered.

Any one of those is a bad day. Together they describe an assurance model that does not hold for this class of device. The implicit promise of an integrity checker is that a customer who runs it can distinguish a clean appliance from a dirty one without commissioning memory forensics. Here it could not — and Shadowserver counts more than 5,500 Connect Secure instances exposed on the internet. Every operator of one is now in the position of having no cheap way to establish whether they were inside the limited set Ivanti refers to.

The blast radius is the directory, not the box

Volexity's list of post-exploitation activity runs through credential theft, Active Directory and LDAP queries, password spraying, data exfiltration, network reconnaissance and log tampering. Two items in the directory queries deserve a second reading: LAPS passwords and BitLocker recovery information. LAPS holds local administrator passwords for domain-joined machines. BitLocker recovery keys unlock disks.

A VPN concentrator sits where it does because it has to authenticate everyone, which means it has to talk to the directory, which means the account it talks with is as interesting to an attacker as anything behind it. An organisation that patches, reboots and moves on has repaired the appliance and not the incident. The remediation that counts is rotating whatever the appliance could read or authenticate as.

Volexity assesses with high confidence that the operation was preparing for lateral movement and wider network compromise when it was disrupted — which is to say nobody got to see what it was for.

The line about language models

One sentence in Volexity's report will be quoted more than the CVE. The firm assesses with medium confidence that the actor, which it tracks as UTA0576 and describes as previously undocumented, uses large language models for exploit development and post-exploitation work, consistent with other operations it has investigated in 2026. It separately assesses with low confidence that the motivation is criminal rather than espionage.

Medium confidence about an unattributed actor is not evidence of a new capability tier and should not be read as one. What it does mark is a shift in what counts as remarkable: model-assisted tooling now appears in an incident report as an ordinary observation about a criminal intrusion, alongside the password spraying.

What an operator should do this week

Upgrade to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1; the 22.7 line and earlier are not affected. Treat the Integrity Checker's verdict as insufficient on its own — Volexity's report sets out the request pattern and routing-header mismatch worth hunting for and publishes indicators, but network and memory forensics are the dependable answer for any appliance that may have been reachable since October 3. Rotate the directory credentials, LAPS passwords and BitLocker recovery keys the appliance could reach. And plan for a second patch, because one flaw in the chain is still open.

Sources: Volexity, Rapid7, BleepingComputer, SecurityWeek, CISA Known Exploited Vulnerabilities catalog