Hackers exploit Ivanti VPN vulnerabilities

Hackers are using security flaws in Ivanti's Connect Secure VPNs to infiltrate company networks and erase evidence of their activities. A recent security alert warns businesses that use this software about the risks.

Vulnerabilities allow unauthorized access

Two vulnerabilities, grouped under the reference CVE-2026-104935, were patched by Ivanti on October 13. These flaws allow attackers to bypass authentication and execute commands remotely, enabling access without user interaction.

Attackers combine multiple flaws

Security researchers found that hackers combined these two flaws with a third, previously unknown vulnerability to gain full control of the system. This allowed them to escalate privileges to the highest level, known as root access, and take over the entire VPN gateway.

Attackers target sensitive data

An unknown group named UTA0576 has been exploiting this method since at least October 3. They accessed identifiers stored on the compromised system and used them to query Active Directory, a Microsoft tool for managing user accounts and network resources.

Hackers hide their tracks

The attackers avoided leaving persistent malware or backdoors. Instead, they re-exploited the vulnerabilities for each command and manipulated logs to erase their presence. This made it difficult to detect the intrusion using Ivanti's built-in security tool.

Ivanti releases patches but one flaw remains

Ivanti has released patches for the first two vulnerabilities but has not yet fixed the third, which allows privilege escalation. The company advises affected organizations to update their software and check for signs of past breaches, as the attack could have gone undetected.