Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and, chained with a privilege escalation, run commands as root. Volexity observed UTA0576 exploiting it from October 3, 2026 (decoys saw attempts from October 1), extracting credentials stored on the appliance, capturing LDAP traffic, running a Kerberoasting tool and searching for administrator passwords and BitLocker recovery keys. CISA added it to its Known Exploited Vulnerabilities catalog with an October 16 deadline.
- Victim
- Multiple: Ivanti Connect Secure VPN operators
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Oct 1, 2026
- First disclosed
- Oct 13, 2026
- Actor
- UTA0576 (Volexity) (Financially motivated)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The VPN appliance was both the front door and a store of directory credentials. Rotating every credential the appliance held or saw after exposure, and using gMSA or long random service account passwords against Kerberoasting, limit the follow-on damage.
Go deeper on SWI
Sources
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts, The Hacker News, Oct 14, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Pulse Connect Secure VPN exploitation and credential harvesting 2021 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-ivanti-connect-secure-uta0576/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.