Ivanti Connect Secure is under fire again. CISA already put it on the list.

Ivanti published an advisory for CVE-2026-104935 on October 13. Same day, CISA put it in the Known Exploited Vulnerabilities catalog with a due date of October 16. The short version: authentication bypass by spoofing on Connect Secure, and from there an unauthenticated attacker can run commands. Ivanti rates it 8.6. They say limited exploitation is already happening. Volexity called the actor UTA0576 and said the chain they saw went further than the login check, including privilege escalation that Ivanti is still finishing a separate fix for.

What dropped today

Affected trains, per Ivanti: 22.8R2.4 and earlier (fixed in 22.8R2.5), 25.1.2.2 and earlier (fixed in 25.1.3.0 / 25.1.3.1), and 25.1.1.1 and earlier on the ISA6000 / ISA8000 line (fixed in 25.1.1.2). The 22.7 branch and older are called out as not impacted by this CVE. We are not going to walk the request path. Volexity's write-up is enough of a hint that this is the same class of edge appliance problem we have seen on Connect Secure before: public login surface, trusted CGI behind it, and an operator who cleans logs after.

Post-compromise behaviour Volexity described is the part that should scare a Canadian shop. LDAP credentials off the appliance, AD metadata, LAPS passwords, BitLocker recovery keys, password spraying from the VPN box itself. No durable web shell in the cases they published. Commands rode the same HTTPS requests as the exploit. Integrity Checker Tool still matters. So does treating a patched-but-previously-exposed appliance as guilty until proven clean.

Why a yard or firm in Alberta should care

Connect Secure is still a common remote-access front door for law firms, contractors, and mid-size IT shops that never moved fully to a cloud VPN. If that box sits on a public IP and has not moved today, you are inside a three-day federal window that private sector should treat as a practical SLA. Lateral movement from the VPN into AD is how a quiet remote-access story becomes a full domain story. That is worse than a phishing ticket.

What we would do before the week ends

Upgrade to a fixed build before you do anything clever. Prefer 25.1.1.2 or later on 22.8 if you can make that jump; otherwise take 22.8R2.5. Run Ivanti's Integrity Checker Tool on a schedule, not once. Pull recent auth and admin logs off the box and off your SIEM if you have one. Look for odd LDAP queries, new local accounts, and lateral attempts that start from the VPN's management or tunnel addresses. If anything smells wrong, plan a rebuild from known-good firmware and rotate every secret the appliance could have touched: LDAP binds, RADIUS, certs, and any AD account used for auth. Do not rely on "we did not see a web shell."

Bottom line

Edge VPN appliances are still the product line attackers like when they want unauthenticated root. Patch CVE-2026-104935 this week. Then prove the box was not already used as a ladder into AD. If you need a second set of eyes on logs or a rebuild plan, that is ordinary assessment work, not drama.