Ivanti Connect Secure: a VPN zero-day has been exploited for weeks, and updating isn't enough

Published on November 1, 2026 · The mitza.es team

When people talk about IT security they think of antivirus software and passwords, but for many companies the way in is something else: the VPN, the device that lets staff connect to the office from outside. By design it is open to the internet, which makes it a prime target. The latest major alert affects Ivanti Connect Secure, a VPN widely used by mid-sized companies and IT service providers. Here is what is known as of November 1, 2026, with the appropriate caution: the investigation is still open.

What happened

On October 13, 2026 Ivanti published its security advisory on CVE-2026-104935, an authentication bypassflaw in Ivanti Connect Secure (the VPN formerly known as Pulse Connect Secure). It lets a remote attacker, without credentials, run commands on the device. Ivanti acknowledged that it had been exploited against a limited number of customers before the patch was published, which is why it is considered a zero-day. That same day the US agency CISA added it to its catalog of actively exploited vulnerabilities (KEV). Rapid7 rates its severity at 8.6 out of 10.

Who exploited it and since when

The security firm Volexity detected the activity and attributes it to a group that had not been identified before, which it tracks as UTA0576. According to Volexity, the attack chain had been in use since at least October 3; another firm places the first signs on October 1. In other words, there were attacks for more than a week before a patch existed. And the flaw did not act alone: the attackers chained it with other vulnerabilities to get code execution with administrator (root) privileges without authenticating, even on devices that were fully up to date at the time.

Affected and fixed versions

According to the data published by Ivanti and collected by Rapid7, the affected versions are 22.8R2.4 and earlier, 25.1.1.1 and earlier and 25.1.2.2 and earlier (in each branch). Versions 22.7.x and earlier are not affected. The fixed versions Rapid7 cites are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Always check Ivanti's official advisory before acting, because it is the source that may be updated.

Why this flaw is especially awkward

Volexity describes a careful attack: it left no malicious programs or backdoors (web shells) that could be found afterwards, it re-exploited the flaw each time it wanted to run a command and it tampered with the device's logs. According to its analysis, this allowed it to evade the integrity-checking tool provided by the vendor itself. The practical consequence is important: the tool finding nothing does not prove the device is clean.

In addition, when the advisory was made public, one of the flaws in the chain (a privilege escalation) was still unpatched. Ivanti said it would fix it later, so it is worth keeping an eye on its upcoming updates.

How to tell whether your company uses Ivanti Connect Secure

• Ask the person or company that manages your IT which VPN you use and which brand it is.
• Check the network equipment inventory: it may be listed as Ivanti, Pulse Secure or Pulse Connect Secure.
• Look at the VPN login page from outside the office: it usually carries the vendor's logo.
• If a provider manages the access, ask them in writing to confirm the version and the date of the last update.

To put the problem in perspective: the monitoring service Shadowserver counts more than 5,500 instances of this product exposed to the internet worldwide, although it is not known how many are already protected or are decoys (honeypots). It is not a Spain-specific figure.

What to do today: checklist

1. Confirm whether you use it and which version you have (see the previous section).
2. Update to a fixed version following Ivanti's advisory. If your device is on an affected branch, treat it as an emergency, not as a task for the next maintenance window.
3. Don't rely only on the integrity tool. Ask for a review of the logs, the connections and the device's activity, ideally by someone with forensic analysis experience.
4. Change credentials and keys that passed through the device if it was exposed before patching: VPN user passwords, service accounts, certificates and access keys. It is a prudent measure recommended by analysts when a compromise is possible.
5. Turn on two-step verification for VPN access and restrict administration of the device to the internal network or to specific addresses.
6. Keep logs off the device (on a separate server), because attackers can tamper with the ones left on the appliance.
7. Record the date and the actions taken. If you later have to report an incident, you'll be glad to have the timeline.

If you think they got in

Signs that justify an urgent review: VPN connections from users who weren't working, logins from unusual countries or time slots, configuration changes nobody remembers making, or logs with gaps. In that case, follow the vendor's recovery steps, isolate the device if possible and notify your IT provider. If personal data is affected, consult your advisor as soon as possible about notifying the data protection authority. You can also ask INCIBE (Spain's national cybersecurity institute) for free help on 017.

How to reduce the risk of a VPN in the medium term

• Make sure VPN access doesn't mean access to everything: segment the network so each user reaches only what they need.
• Keep an inventory of edge devices (VPNs, firewalls, gateways) with their version and an owner.
• Subscribe to alerts from the vendor and from INCIBE-CERT, and set a maximum patching window for critical flaws (for example, 48 hours).
• Consider alternatives when a product piles up serious flaws: identity-based access (“zero trust” models), another vendor or managed services.
• Keep independent, tested backups, in case you have to reinstall: we explain it in the 3-2-1 backup rule.

It's not an isolated case: edge devices under attack this autumn

Ivanti's advisory adds to others we have already covered: the Citrix NetScaler zero-days and the vulnerabilities in the Cisco and FortiMail email gateways. The pattern repeats: attackers go after the devices that guard the entrance to the network, because compromising them gives access to everything else. If you want to understand how that first line of defense is organized, read our guide to what a firewall is and what a small business needs. And for the threat landscape, see the article on ransomware in Spanish companies, because an intrusion through a VPN is one of the most common ways in.

Quick questions

Does it affect me if I only use a VPN from another vendor?

This specific advisory, no. But the general advice does apply: know which devices you have exposed to the internet, keep an update calendar and require your provider to commit to a maximum patching window for critical vulnerabilities.

Is updating enough?

Not necessarily. There was exploitation before the patch and the attack was designed to leave little trace. After updating, you should check whether there was an intrusion and change the credentials that passed through the device.

Does this have anything to do with the NIS2 regulation?

Vulnerability and supplier management are part of the measures expected of the companies the directive covers. You can find the context in our guide to the NIS2 regulation for small businesses.

How we can help at Mitza

We review your network, your remote access and your exposed devices, and help you update and check whether there was an intrusion. If you're in southern Madrid, see our IT maintenance service, or tell us about your case on the contact page.