Ivanti VPN Attacks Target Active Directory Credentials: What Businesses Must Do

A VPN is supposed to provide a secure connection between remote employees and business systems. But when attackers compromise the VPN appliance itself, the device that protects remote access can become an entry point into the organization's internal network. That is the concern surrounding actively exploited vulnerabilities in Ivanti Connect Secure.

On October 30, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two more Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws are part of an attack chain that security researchers previously observed being used to obtain privileged access and search for sensitive Active Directory credentials.

For small businesses, healthcare providers, and any organization that relies on remote access, the incident highlights a critical lesson: protecting employee passwords is not enough if the systems that manage authentication are themselves vulnerable.

What happened in the Ivanti Connect Secure attacks?

Security company Volexity investigated suspicious activity involving an Ivanti Connect Secure VPN appliance in early October. The researchers found that a threat actor they track as UTA0576 had exploited multiple vulnerabilities against an appliance that was fully patched at the time of the attack.

The exploit chain allowed the attacker to bypass authentication, execute code, and ultimately gain root privileges. Root access provides extensive control over the affected appliance. According to Volexity, the attacker then investigated the organization's internal environment and attempted to obtain credentials and other sensitive authentication information.

The research identified exploitation beginning October 3, 2026. Volexity published its initial findings on October 13 and updated its report after Ivanti released additional fixes on October 29. The important point for a non-specialist reader: the appliance was current on patches and was still compromised, which is why this story is about more than "install the update."

Which vulnerabilities are involved?

Three CVE identifiers are central to the incident:

• CVE-2026-104935: authentication bypass and remote code execution.
• CVE-2026-111357: privilege escalation to root.
• CVE-2026-118527: predictable identifiers involved in the exploited file-upload chain.

CISA added the first vulnerability to its Known Exploited Vulnerabilities catalog on October 13. The other two were added on October 30, confirming that all three components of the reported chain were associated with observed exploitation. This is not merely a theoretical security issue. The exploitation was observed during an actual incident investigation.

What credentials did attackers target?

The most concerning aspect of the incident is what happened after the VPN appliance was compromised. Volexity reported that the attacker extracted credentials stored on the appliance, including domain credentials used for LDAP authentication.

The attacker also queried Active Directory and searched for sensitive information such as local administrator passwords, BitLocker recovery information, and password-related directory attributes. Researchers additionally observed password spraying, credential testing, and attempts to capture authentication information from network traffic.

These activities show how compromising a network access device can expose authentication material that supports access to other business systems. One clarification matters here: the investigation does not establish that every Ivanti customer suffered credential theft. The reported actions were observed in the single environment Volexity investigated.

Why Active Directory credentials matter

Active Directory is widely used to manage users, computers, and access permissions in business environments. It helps determine which employees can sign in and which resources they can access. If attackers obtain usable domain credentials, they may attempt to authenticate to additional systems.

The impact depends on the privileges attached to the credentials and the organization's security controls. A compromised low-privilege account presents a different risk from a service account with broad directory permissions. For example, a small healthcare company might use Active Directory to manage employee access to file servers, billing applications, and internal workstations. If a privileged directory account is exposed, the organization may need to investigate multiple connected systems, not just the original VPN appliance. This is the same pattern we described in what to do when an employee's work credentials are exposed: one stolen login rarely stays contained to one system.

Why ordinary security checks may miss this attack

Volexity found that the attacker used techniques designed to reduce evidence of compromise. The attacker modified information in memory, restored certain changes, and attempted to remove relevant log entries. The researchers reported that Ivanti's Integrity Checker Tool did not identify the particular changes associated with the observed exploit chain.

This means a routine scan returning no findings cannot always establish that an appliance is safe. Organizations with evidence of exploitation need a broader investigation that considers authentication logs, network activity, system memory, and other available evidence. This work should be performed by qualified security personnel or an experienced incident response provider, not inferred from a single clean tool result.

What businesses should do now

1. Identify affected VPN appliances. Ask your IT team or managed service provider whether your organization uses Ivanti Connect Secure. Determine the exact software version and whether the appliance is exposed to the internet.
2. Apply the latest vendor security updates. According to Ivanti's updated guidance, the relevant fixes include versions 25.1.1.3 and 22.8R2.6 for affected branches. Confirm the appropriate supported release for your specific deployment rather than relying on an older patch.
3. Investigate possible compromise. If the appliance was vulnerable during the exploitation period, review the vendor's guidance and relevant indicators of compromise. Where suspicious activity is identified, escalate to qualified incident responders.
4. Review credentials accessible to the appliance. Identify LDAP service accounts, directory credentials, and other authentication secrets stored or used by the VPN. Rotate potentially compromised credentials from trusted systems, coordinating changes with dependent applications.
5. Review Active Directory activity. Look for unusual authentication events, password spraying, privileged-account activity, and unexpected access to sensitive directory information.
6. Restrict service-account permissions. VPN integration accounts should receive only the permissions required for their intended purpose. Avoid granting broad administrative access to accounts used for routine authentication.
7. Strengthen remote-access security. Use multifactor authentication, limit administrative access, maintain appropriate network segmentation, and regularly review VPN configuration. These measures reduce risk, although MFA does not prevent exploitation of the VPN appliance itself.

What should healthcare practices and small businesses learn?

Smaller organizations frequently outsource VPN management to an IT provider. That does not remove the need to understand which remote-access technologies are in use and whether security updates are applied promptly.

A healthcare practice should be able to identify its remote-access provider, determine who manages security updates, and know whom to contact when an actively exploited vulnerability is announced. Businesses should also maintain an inventory of accounts used by network appliances to connect to internal identity systems. These service accounts are easy to overlook during ordinary password reviews, yet they are exactly what this attack went after. If your organization handles patient data, pair this with the practices in our guide to dark web monitoring for healthcare and HIPAA.

How GuardPilot fits into the response

It is important to be precise about the boundary here. GuardPilot does not scan Ivanti appliances, inspect Active Directory, detect VPN exploitation, or perform forensic investigations. Credentials stolen during a private intrusion may never appear in the intelligence sources GuardPilot monitors. Any organization affected by this incident must follow Ivanti's security guidance and investigate its own environment independently of any credential-exposure monitoring results.

Where GuardPilot helps is the complementary problem. GuardPilot is the AI Incident Response Platform for Credential Exposure. It continuously watches dark-web marketplaces and infostealer stealer logs for your organization's emails, domains, and logins. When a known exposure surfaces, its AI investigates what happened, explains in plain English what is at risk, and walks a non-technical owner or office manager through a step-by-step fix, then reminds you until the incident is resolved. Competitors hand you a list and leave; GuardPilot turns a scary alert into a handled incident. As part of a broader credential-security program, that is how you catch the other exposed employee accounts that attacks like this one tend to leave behind. Worried a business login has already leaked? Check your credential exposure, or see how dark web monitoring works.

Frequently asked questions

Are the Ivanti vulnerabilities being actively exploited?

Yes. Volexity documented exploitation in a real incident, and CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog.

Does installing the latest patch guarantee an organization is no longer compromised?

No. Patching closes known vulnerabilities but does not automatically remove unauthorized access or resolve credentials stolen during an earlier compromise. Investigation is still required where exploitation is possible.

Were all Ivanti Connect Secure customers affected?

No such conclusion has been established. Organizations need to evaluate their own versions, internet exposure, and available evidence.

Can credential-exposure monitoring identify passwords stolen directly from a VPN appliance?

Only if the relevant credentials later appear in supported exposure data. It cannot reliably detect private credential theft that has not surfaced in those sources, which is why appliance patching and internal investigation come first.

Sources and further reading

• Volexity: Chained exploitation of Ivanti Connect Secure zero-days.
• The Hacker News: Attackers chain three Ivanti Connect Secure flaws.
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527).

The takeaway

The Ivanti Connect Secure attacks demonstrate how a vulnerability in a remote-access appliance can create risks across an organization's identity infrastructure. Businesses should update affected systems, investigate suspicious activity, protect service accounts, and review potentially exposed directory credentials. Strong credential security means protecting both employee accounts and the infrastructure that authenticates them.