Ivanti Connect Secure Zero-Day Exploited to Steal Active Directory Credentials

The Ivanti Connect Secure zero-day, tracked as CVE-2026-104935, has prompted an urgent warning from the Cybersecurity and Infrastructure Security Agency (CISA). Attackers have reportedly exploited the authentication bypass vulnerability since at least October 1, 2026, targeting sensitive enterprise credentials.

The vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable remote-access gateways without requiring user interaction.

Security reporting also links exploitation to attempts to obtain Active Directory credentials, local administrator passwords, and BitLocker recovery keys. With Ivanti releasing security fixes and CISA adding the vulnerability to its Known Exploited Vulnerabilities catalog, organizations must prioritize remediation.

What happened in the Ivanti Connect Secure attacks?

CISA urged immediate remediation of CVE-2026-104935 after reports of active exploitation. Ivanti released security updates, confirming limited attacks in the wild.

A threat intelligence firm reported that an unidentified attacker chained the flaw with two additional vulnerabilities to achieve unauthenticated root-level code execution.

Following exploitation, the attacker targeted several sensitive enterprise assets:

• Active Directory credentials: Authentication information associated with enterprise identities.
• LAPS passwords: Local administrator credentials that could provide privileged endpoint access.
• BitLocker recovery keys: Recovery information that could enable access to encrypted drives.

CISA subsequently added the vulnerability to its Known Exploited Vulnerabilities catalog. The agency also directed federal organizations to accelerate remediation under Binding Operational Directive 26-04. These developments establish an immediate patching priority for organizations operating affected Ivanti gateways.

How does CVE-2026-104935 work?

The Ivanti Connect Secure zero-day affects authentication controls within enterprise remote-access infrastructure.

CVE-2026-104935 covers an authentication bypass and remote code execution mechanism that attackers combined to execute commands without authentication.

Reported exploitation involved three distinct stages:

• Authentication bypass: The attacker exploited CVE-2026-104935 to execute commands without valid credentials.
• Vulnerability chaining: Two additional flaws enabled the attacker to achieve unauthenticated remote code execution.
• Privilege escalation: Attackers manipulated the internal dsinvoked process in memory to elevate privileges to root.

Ivanti’s fixes for CVE-2026-104935 address the authentication bypass and remote code execution flaws. However, the separate root privilege-escalation flaw remained unpatched at disclosure, making perimeter isolation and post-compromise credential and key rotation essential.

Volexity identified CGI request-routing abuse, a file-upload race condition, and a separate privilege-escalation flaw as components of the exploit chain.

However, the reported activity demonstrates how compromising a remote-access gateway can create risks beyond the initial system.

What enterprise assets face exposure?

These consequences depend on which credentials attackers obtain and whether they can access the associated resources.

Why does this vulnerability matter for enterprises?

Remote-access gateways connect users to internal enterprise resources. Their compromise can therefore affect systems beyond the gateway itself.

The reported credential-targeting activity creates several concerns:

• Identity compromise: Exposed credentials could enable unauthorized access to enterprise systems.
• Privilege abuse: Stolen administrator passwords could increase attackers’ access to managed endpoints.
• Data exposure: Compromised recovery keys could undermine disk encryption protections when attackers also obtain the relevant encrypted drives.
• Lateral movement: Valid credentials could support unauthorized movement across connected systems.

Patching the gateway addresses the vulnerable software, but it does not automatically resolve previously exposed credentials.

Security teams must investigate potential credential compromise alongside infrastructure remediation.

Featured resource

Building a cybersecurity framework for your enterprise

Explore cybersecurity frameworks and learn how UEM strengthens organizational security, compliance, and protection against cyberthreats.

How can Hexnode help reduce exposure?

Addressing the Ivanti Connect Secure zero-day requires vendor patching alongside stronger identity and endpoint security controls. Hexnode IdP and Hexnode UEM can support these complementary security measures.

Hexnode IdP: Strengthen identity and access security

It helps organizations strengthen authentication and manage access to enterprise resources.

IT teams can use Hexnode IdP to:

• Neutralize stolen credentials: Enforce mandatory phishing-resistant MFA so compromised Active Directory passwords alone cannot authenticate.
• Context-based conditional access: Block unauthorized access attempts by enforcing device compliance and location-aware policies before granting entry to corporate apps.
• Manage user permissions: Control access to enterprise applications through user and group assignments.

Hexnode UEM: Maintain endpoint security and compliance

Hexnode UEM helps administrators monitor managed devices and enforce consistent endpoint security policies.

IT teams can use Hexnode UEM to:

• Rotate BitLocker recovery passwords: Remotely trigger recovery key rotation on Windows devices and securely escrow new keys in Hexnode UEM to neutralize stolen recovery data.
• Automate LAPS password rotation: Enforce Windows and macOS LAPS policies to instantly rotate compromised local administrator passwords and contain lateral movement.
• Enforce endpoint hygiene: Verify connecting endpoints run compliant, patched OS builds before allowing access to corporate resources.

These capabilities complement Ivanti’s security fixes. They do not directly remediate the gateway vulnerability or reverse credential exposure.

What should organizations prioritize?

Security teams should coordinate infrastructure remediation with credential and endpoint security reviews.

The immediate priorities include:

• Apply the appropriate Ivanti security update.
• Investigate affected appliances using network and memory forensics.
• Review potential Active Directory credential exposure.
• Force-rotate Active Directory passwords, endpoint LAPS credentials, and BitLocker recovery keys across all systems potentially exposed via the gateway.
• Follow CISA’s appliance recovery and credential-rotation guidance for confirmed compromises.

These actions help organizations address both the vulnerable gateway and the potential consequences of exposed credentials.

Conclusion

The Ivanti Connect Secure zero-day demonstrates how vulnerabilities in remote-access infrastructure can threaten enterprise identity systems and endpoint security.

Organizations should prioritize Ivanti’s fixes while investigating potential credential exposure. Reviewing administrator passwords, encryption recovery keys, and endpoint compliance can help reduce the consequences of a compromised gateway.

Coordinating vendor remediation with identity and endpoint security controls provides a more comprehensive response to this threat.