The incident

An edge device became a route into the directory

Volexity was called to investigate suspicious activity in early October. The starting point was an Ivanti Connect Secure appliance running 22.8R2.4—the current patch at the time. The attacker chained an authentication bypass, code execution and a separate privilege-escalation flaw to run commands as root without signing in.

Once inside, the attacker did not stop at the VPN. Volexity observed attempts to obtain credentials held by the appliance, query Active Directory, search for LAPS passwords and BitLocker recovery keys, and spray passwords against accounts. Those are observations from Volexity's investigation, not evidence that every vulnerable appliance suffered the same sequence.

What the October patch does

Ivanti released fixes for the authentication-bypass and code-execution path tracked as CVE-2026-104935 on 13 October. Volexity says a separate privilege-escalation fix was still being developed. Check Ivanti's advisory for the correct build for your appliance; do not assume that installing it answers whether the device was already used.

Why a normal check may miss it

The attacker tried to leave very little on disk

Volexity says commands and results travelled through the exploit requests themselves. It did not find a webshell on the investigated appliance. The attacker also removed selected debug and audit log entries and restored altered in-memory state. In this case, Ivanti's integrity checker could not detect the activity Volexity reconstructed from memory, core dumps and other forensic evidence.

That is a useful warning about the limits of a clean-looking appliance, not a reason to abandon routine checks. Keep the integrity check, but pair it with network, identity and endpoint evidence that the appliance cannot erase.

Defender note

Make two decisions, not one

  1. 1

    Close the entry point. Inventory exposed Connect Secure appliances, record their exact builds and apply Ivanti's applicable update. Verify the result on each device.

  2. 2

    Scope the time before the fix. Preserve appliance evidence and review external network, VPN authentication and directory logs. Look for access from the VPN host to domain controllers, credential stores and other systems it should not normally touch.

  3. 3

    Treat stolen secrets as a separate workstream. If compromise is plausible, assess LDAP bind credentials, service accounts, LAPS and BitLocker material that the appliance could reach. Plan rotation and recovery with identity and incident-response owners rather than declaring the case closed when the patch lands.