Ivanti again. If you manage Ivanti Connect Secure, I'm sorry, but this one can't wait for the next change window.
On 13 October, Ivanti disclosed CVE-2026-104935. Attackers can run commands on the VPN box without logging in. Score is 8.6. And the worst part: it was already being used before the patch existed. CISA put it on the Known Exploited list the same day.
What actually happened
Volexity caught attackers using it in early October against a small number of customers. Classic zero-day. The bad guys had it first.
But here's the bit that bothers me more. In the same attack, they also used a second bug, a privilege escalation, which Ivanti hasn't fixed yet. So when you patch, you close the main door. The second one is still being worked on.
Which versions?
| If you're on… | Go to… |
|---|---|
| 25.1.1.1 or older | 25.1.1.2 |
| 25.1.2.2 or older | 25.1.3.0 or 25.1.3.1 |
| 22.8R2.4 or older | 22.8R2.5 |
The advisory says 22.7.x and below aren't affected. Also, 22.8 goes end of life on 31 January 2027, so if you're on it, start planning 25.x anyway.
What I'd do, step by step
First, patch. Today, not on the next Sunday window. Rapid7 and CISA are both saying emergency.
Then, assume someone may have been in. If your box was on the internet in October, go looking. Some reports say the attacker's commands run in memory, which means Ivanti's Integrity Checker might not see them. Use the indicators Volexity published, and check your logs properly.
Found something? Then patching is not enough. Follow Ivanti's recovery steps. Usually that's a factory reset and rebuild, and changing every password, key and certificate that box ever touched. Painful, I know.
Keep an eye out for fix number two. Subscribe to the advisory so you don't miss it.
My honest opinion
VPN boxes are on the internet, they hold everyone's credentials, and the internal network trusts them completely. Of course attackers go after them. Last month a different vendor, next month maybe another one. If you've been thinking about moving remote access to zero trust, where the app is never directly reachable from the internet, this is a good week to bring it up with your team.
Personal view only. Always check Ivanti's advisory for the latest versions and steps.
Comments
No comments yet. Share your own debugging war story.