An authentication bypass in Ivanti Connect Secure SSL VPN appliances has been exploited since 3 October. Once inside, attackers harvest domain accounts, local administrator passwords and BitLocker recovery keys.
On 13 October 2026 the US Cybersecurity and Infrastructure Security Agency added a flaw in Ivanti Connect Secure SSL VPN appliances to its Known Exploited Vulnerabilities catalogue. The bug, tracked as CVE-2026-104935, lets an attacker bypass authentication and run commands on the appliance — but the real target is the corporate network behind it.
What the flaw does
Ivanti classifies the issue as an authentication bypass by spoofing: a remote attacker can send commands to the device without holding a valid user account. According to Volexity, a group it tracks as UTA0576 began exploiting the weakness on 3 October 2026, while Ivanti's fixes shipped on 13 October — roughly ten days in the wild as an unpatched zero-day.
Ivanti's advisory lists the affected builds as 22.8R2.4 and earlier, 25.1.1.1, and 25.1.2.2 and earlier; the 22.7.x line is not affected. Fixed releases are 22.8R2.5, 25.1.1.2 and the 25.1.3.x branch. The vendor also notes that no reliable indicators of compromise are available yet, so "we scanned and it came back clean" is not a defensible answer here.
Why it matters
On an architecture diagram a VPN gateway looks like a networking box. In practice it is a credential store, and the post-exploitation activity makes that plain. Volexity observed attackers collecting stored domain credentials from compromised appliances, querying Active Directory, hunting for local administrator passwords and BitLocker recovery keys, then moving on to password spraying. At that point the incident is no longer a VPN bug; it is an attempt to take over the domain.
A second deadline is worth noting: Ivanti has set end of life for the 22.7 and 22.8 lines at 31 January 2027. Organisations still on those branches need a migration plan, not just a patch, with only a few months on the clock.
What this means for Turkish SMBs
For smaller companies that rely on SSL VPN for remote work, branch links, field teams and supplier access, the gateway is often the only corporate server exposed to the internet — the same picture across construction offices, shipping agencies, logistics operators and production sites. If the VPN falls, the file server, the accounting application and the mail accounts behind it are exposed at the same moment.
There are compliance consequences too. Article 12 of Turkey's Personal Data Protection Law (KVKK, No. 6698) requires a breach affecting personal data to be reported to the Authority without undue delay, a period the Board applies as 72 hours, and the Cybersecurity Law No. 7545 has made notification and record-keeping duties more visible still. In a credential-theft incident, whether you can answer "was data exfiltrated?" depends entirely on the logs you kept.
What we recommend at Kamer Bilişim
- Confirm your build, then patch on a planned window. If you run Ivanti Connect Secure, check the running version today; on 22.8R2.4 or earlier, 25.1.1.1, or 25.1.2.2 and earlier, open a maintenance window for the vendor's fixed release. On the 22.7/22.8 branch, fold the 31 January 2027 end-of-life date into the same plan.
- Do not treat the patch as case closed; rotate credentials. With no reliable indicators of compromise available, the safe path after patching is to change service-account passwords on the appliance, reset the domain accounts configured for VPN access and local administrator passwords, invalidate active session tokens, and rotate BitLocker recovery keys.
- Stop letting the VPN be the only door. Take the management interface off the public internet, enforce multi-factor authentication for every VPN user, and never grant domain administrator rights to VPN accounts. Shipping appliance logs to a central server is what makes scoping possible next time.
We can review whether your remote access infrastructure is affected and handle the version check and patch planning with you, on site across the Anatolian side of Istanbul and remotely elsewhere. Get in touch through our contact page.
Source: CISA Known Exploited Vulnerabilities alert (13 October 2026), Ivanti security advisory, and Volexity's UTA0576 analysis.
Source: CISA