Ivanti patches exploited Connect Secure flaw; another stays open
Ivanti released updates for CVE-2026-104935 in its Connect Secure VPN, but a third flaw in the same attack chain still has no fix.
Ivanti has released updates for CVE-2026-104935, a flaw in Connect Secure, its VPN remote-access gateway, that attackers were already exploiting before it was disclosed. Ivanti's security advisory says the company is aware of "limited exploitation in the wild" and is working with affected organizations.
The flaw lets an attacker bypass authentication and run code remotely, with low complexity and no user interaction, according to BleepingComputer. Three Connect Secure branches are affected: 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. The fixed version number and the CVSS severity score could not be confirmed: Ivanti's advisory did not load when consulted and no other source gives them.
A chain of three flaws
The security firm Volexity, in its analysis, attributes the attacks to UTA0576, a group previously unknown to the firm, which chained three vulnerabilities and gained full control (root access) of devices that had the earlier patches installed. Ivanti fixed two. The third, a privilege escalation flaw with no CVE identifier in the report, remains unpatched, and the company has given no date.
Volexity places the start of exploitation on Oct. 3 at the earliest. The firm Defused saw signs from Oct. 1, according to BleepingComputer. Neither date has been confirmed by a source independent of the investigators.
Shadowserver, an organization that tracks exposed devices, counts more than 5 500 Connect Secure instances reachable from the internet, according to BleepingComputer. The exploited-vulnerabilities catalog of CISA, the U.S. cybersecurity agency, already lists 36 Ivanti flaws.
Who is at risk
An ordinary user is not directly exposed: the risk is to companies and agencies that use Connect Secure to give staff remote access, including in Mexico. A device of this kind sits at the edge of a network, so a flaw there opens a way into the internal network.
Ivanti recommends updating as soon as possible, running its Integrity Checker Tool regularly and reviewing logs. Volexity warns that the tool may fail to detect this compromise, because the attacker modified memory and restored the configuration, and that a device showing signs of intrusion needs network and memory forensics, not just the patch.
As to who is behind it, Volexity attributes a criminal rather than espionage motive with low confidence and, with medium confidence, suspects the attackers use large language models to build their exploits. These are the firm's assessments. There are no reports of victims in Mexico, and the CVE did not yet appear in the NVD database or in CISA's catalog when this article was closed.
