Ivanti VPN zero-day exploited in attacks, NHS says
Security researchers found an attack chain that gave attackers root access to a fully patched appliance.
A vulnerability in Ivanti Connect Secure VPN devices is being exploited in the wild, NHS England has warned. Researchers say attackers chained three previously unknown flaws to gain unauthorised, root-level access to at least one fully patched appliance.
Ivanti disclosed the vulnerability on 13 October and released an update addressing the authentication-bypass and remote-code-execution elements of the attack. NHS England Digital said the flaw, identified as CVE-2026-104935, could allow an unauthenticated attacker to run commands remotely and that further exploitation was highly likely.
The alert applies to several versions of Ivanti Connect Secure listed by the vendor, including versions in the 25.1 and 22.8 branches. NHS England rated the threat as medium in its own alert, but gave the vulnerability a CVSS score of 8.6 and urged affected organisations to review Ivanti’s advisory and apply the relevant update.
Volexity, the security company that investigated the incident, said it found the exploitation during the first week of October. Its researchers attributed the activity to an unidentified actor they track as UTA0576, which began compromising a customer’s appliance on 3 October.
According to Volexity, the appliance was running version 22.8R2.4 and had been fully patched at the time. The actor combined an authentication bypass, a file-write flaw and a privilege-escalation weakness to obtain root-level execution without logging in. Volexity said the privilege-escalation issue still required a separate fix when it published its findings.
The investigation found attempts to collect credentials and information from the customer’s Active Directory environment, including local administrator passwords and BitLocker recovery data. Volexity also said the attacker altered or removed some logs, meaning that the appliance’s normal integrity tool alone might not reveal a compromise.
The public reports do not identify the affected customer or say whether any UK organisation was breached. The immediate significance for British businesses and public bodies is that the warning concerns an enterprise VPN product used for remote access, while the evidence of exploitation predates the public disclosure. Organisations using affected appliances will need to establish whether they were compromised, not only whether they installed the update.
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The central claims are supported by a UK public-sector cyber alert and the incident response report that identified the exploitation. The sources do not establish the victim’s identity or any British breach, and the article states those limits clearly.
- confirmed NHS England Digital said CVE-2026-104935 was being exploited in the wild and assessed further exploitation as highly likely. — Stated in the NHS England Digital cyber alert published on 13 October 2026. source
- confirmed The vulnerability can allow unauthenticated remote command execution and has a CVSS score of 8.6. — Both details appear in the NHS England Digital alert. source
- confirmed Volexity found exploitation of a fully patched Ivanti Connect Secure appliance in the first week of October. — Volexity dates its investigation and describes the appliance as fully patched at the time. source
- confirmed The attacker chained three vulnerabilities to obtain unauthenticated root-level execution. — This is the technical conclusion in Volexity’s incident report. source
- confirmed The public reports do not identify the victim or confirm a UK breach. — Neither cited source identifies the customer or reports a British victim. source
Editor's note
The exploitation, affected product and technical findings are documented by NHS England Digital and Volexity. The victim organisation, the attacker’s ultimate objective and any UK compromise remain unknown.Sources
More on this in other media
- Channel 4 News — „ivanti cyber-security”
- BBC News — „ivanti cyber-security”
- The Guardian — „ivanti cyber-security”