The device that decides who gets into your network let a stranger in with a single header — and then went looking for your domain passwords.

CISA has urged organisations to update Ivanti Connect Secure immediately after Ivanti disclosed CVE-2026-104935, a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands. CISA added it to its Known Exploited Vulnerabilities catalogue on 13 October; affected are versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Volexity, which uncovered the chain, says a previously unknown actor it tracks as UTA0576 began exploiting it on 3 October against an appliance that was fully patched at the time. The bypass is remarkably simple: a request to the public login script carries a header naming a protected one, so the URL decides whether it is allowed and the header decides where it goes. Chained with a file-upload race and a separate privilege-escalation flaw that Volexity says Ivanti will fix in a future release, it gave the attacker root. UTA0576 then pulled domain credentials stored on the appliance, used its Active Directory service account to search for LAPS administrator passwords and BitLocker recovery keys, captured LDAP traffic and sprayed passwords. No web shell, no backdoor: it re-exploited the device for every command and trimmed logs as it went. The Hacker News reports that Previdian logged 105 exploitation attempts against its honeypots from 50 IP addresses geolocated to Singapore and the US, and Hong Kong’s GovCERT.HK has issued a high threat alert.

We still file the VPN under network infrastructure. It is an identity system: it holds directory credentials, a service account that can query Active Directory, and every login that crosses it. When authentication itself is bypassed, the MFA you put in front of it never comes into play, and the attacker inherits whatever the appliance can see. Detection is the harder problem. CISA warns that Ivanti’s Integrity Checker Tool may not detect exploitation because the commands execute in memory, so a clean integrity check is not an answer you can take to your board. Volexity also assesses with medium confidence that UTA0576 uses large language models for exploit development.

For APAC teams, geolocation is not attribution, but exploitation infrastructure is already sitting in our region. Assume scanning reaches your appliances before your next change window does.

What security leaders should do:

• Upgrade every Connect Secure appliance now per Ivanti’s advisory, track the pending privilege-escalation fix, and plan off 22.8, which reaches end of life on 31 January 2027.
• Hunt for requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header, using network and memory forensics, not the Integrity Checker alone.
• If you suspect compromise, follow CISA’s steps: factory reset or rebuild, reset passwords for all domain, administrator and local accounts, reissue certificates and reset API keys.
• Treat the VPN’s directory service account as exposed: cut it to least privilege, block it from LAPS passwords and BitLocker keys, and alert on LDAP queries for them.
• Watch for password spraying and Kerberos credential testing that originates from the appliance’s internal address.

Your VPN is not just a door to the network. It holds keys to the directory, so defend it like an identity system, not a box at the edge.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#IdentitySecurity #ZeroDay #VPN #APAC #CyberSecurity

Sources: CISA · Volexity · The Hacker News · GovCERT.HK