Volexity has disclosed that three chained flaws in Ivanti Connect Secure VPN appliances grant unauthenticated root access. Attackers used compromised devices to steal domain accounts, LAPS passwords and BitLocker recovery keys.
Corporate remote access infrastructure is back in the crosshairs. According to research published by security firm Volexity on 13 October 2026, three separate flaws in Ivanti Connect Secure VPN appliances can be chained together to give unauthenticated attackers root-level command execution on the device.
The first two links in that chain are tracked as CVE-2026-104935. A routing fault in the login component lets attackers bypass authentication, while a race condition in the file upload handler allows an uploaded script to run before it is validated. The third flaw is a privilege escalation issue caused by a privileged service placing too much trust in configuration data. Volexity reports that Ivanti shipped a patch for the first two issues on 13 October; the fix for the privilege escalation flaw is expected in the coming weeks.
Why this matters
Compromising the appliance was the beginning of the attack, not the end of it. The group Volexity tracks as UTA0576 pulled LDAP domain account credentials, LAPS local administrator passwords and BitLocker recovery keys out of the VPN appliances it reached. From there it attempted lateral movement inside Active Directory using Kerberoasting, password spraying and the interception of LDAP traffic, and it also tampered with debug and audit logs.
Two details make the picture worse. First, exploitation began before the patch existed: Volexity dates the earliest evidence of exploitation to 3 October 2026, roughly ten days before the fix was released. Second, Volexity warns that Ivanti's own integrity checker may fail to detect a compromise, so a clean-looking report is not proof on its own.
The US cybersecurity agency CISA added the flaw to its catalogue of actively exploited vulnerabilities and ordered federal agencies to patch urgently under Binding Operational Directive 26-04, while urging every organisation to patch without delay. Shadowserver figures cited by BleepingComputer put more than 5,600 internet-facing servers carrying an Ivanti Connect Secure fingerprint.
What this means for SMEs in Turkey
Many SMEs in Turkey have relied on SSL VPN appliances for years as the single door through which branch offices and field staff reach the network. They sit at the perimeter, are exposed to the internet, and often fall outside any regular maintenance scope. Yet the kind of data stolen in this campaign, namely domain accounts, local administrator passwords and BitLocker keys, is exactly the kind that can trigger a data breach notification and an administrative process under Law No. 6698. Because KVKK's breach notification window is just 72 hours, patching the device does not close the matter; whether the appliance was actually compromised has to be investigated separately.
What we recommend at Kamer Bilişim
- Confirm your version today and do not defer the patch. If you run Ivanti Connect Secure, check the appliance version and move to the current release the vendor has published. Because the privilege escalation flaw is still unpatched, take the management interface off the public internet entirely and restrict it to a defined set of IP ranges.
- Rotate credentials after patching. The LDAP and service account passwords, LAPS administrator passwords and BitLocker recovery keys stored on the appliance do not become invalid when the patch is applied. Those secrets need to be renewed, and Active Directory should be reviewed retroactively for unusual Kerberos requests and clusters of failed sign-ins.
- Bring perimeter devices into a maintenance scope. Keep a version inventory for firewalls, VPNs and remote access appliances, follow vendor security bulletins, and define a monthly patch window. Multi-factor authentication, together with separate accounts for administrators, keeps a single stolen password from being enough to enter the network.
If you would like us to check whether your VPN and firewall infrastructure is affected, build a version inventory, or bring your perimeter devices under regular maintenance, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Volexity, CISA, BleepingComputer
Source: Volexity