Why remote access gateways are targeted
SSL VPNs, remote access gateways and remote support tools share three traits that make them ideal targets:
- They are exposed to the Internet by design.
- They give access to the internal network and often store privileged credentials.
- They are closed appliances where you can't install an EDR, which makes intrusions hard to detect.
The result: every month brings its batch of critical flaws. In October 2026, CISA added several of them to its KEV catalog (Known Exploited Vulnerabilities), two of them particularly serious.
1. Ivanti Connect Secure: CVE-2026-104935
- Type: authentication bypass by spoofing (CWE-290), CVSS 8.6.
- Impact: a remote, unauthenticated attacker can execute commands.
- Exploitation: active since early October 2026. Volexity attributes the activity to an actor it tracks as UTA0576, which chains this flaw with two others to gain root access on devices that were otherwise up to date.
- Added to the KEV catalog: October 13, 2026.
Fixed versions (according to published reports, to be confirmed in Ivanti's advisory): 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Note: the 25.1.3.x line only runs on the new hardware platforms or on virtual appliances rebuilt from the new template.
The worrying part: the attacker dropped no malware and no web shell. They re-exploited the flaw for each command and wiped logs, which let them evade Ivanti's integrity checking tool. One flaw in the chain (privilege escalation) had no fix yet at the time of the first reports.
2. BeyondTrust Remote Support: CVE-2026-102764
- Type: authentication bypass (CWE-290), CVSS v4 9.3.
- Impact: file operations on the appliance without authentication or interaction.
- Affected versions: Remote Support 26.2.3 and earlier without the BT26-05-RS patch. Self-hosted Privileged Remote Access (PRA) shares the affected code.
- Exploitation: since August 29, 2026, attributed by Mandiant to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage actor.
- Added to the KEV catalog: October 16, 2026, with an October 19 remediation deadline for US federal agencies.
Observed activity: file uploads, PHP web shell, tunneling tool, root escalation, attempted credential-vault extraction, persistence and log deletion.
Fix: apply the BT26-05-RS patch (available from 24.3.1 to 26.2.3). Below 24.3.1, you must first move to a supported version. SaaS customers were patched on October 9.
3. The right procedure: patching is not enough
On an edge device exploited for weeks, applying the patch does not remove any persistence the attacker may have set up. The recommended procedure:
Step 1: preserve evidence
Before any reboot or update, export the logs and take a snapshot of the appliance (or VM). A reboot can wipe in-memory traces.
Step 2: patch urgently
Apply the official patch. For self-hosted appliances, check in the admin interface that the update is actually installed, especially if automatic updates are disabled.
Step 3: hunt for signs of compromise
- Unknown admin sessions, especially from residential or commercial VPN IP addresses.
- Unexpected scripts in web directories, shell processes spawned by the web service account.
- Unexplained changes to accounts, permissions or session policies.
- Gaps in logs or interrupted forwarding to the SIEM.
- For Ivanti: run the Integrity Checker Tool, keeping in mind it wasn't enough against UTA0576.
The absence of known indicators does not prove the device is clean.
Step 4: rebuild if in doubt
If compromise is confirmed or can't be ruled out: reinstall from a clean, fully patched image rather than "cleaning" the existing one.
Step 5: rotate every secret
Admin passwords, service accounts, credentials stored in the vault, certificates, API keys: everything that went through the device must be treated as compromised.
4. Reducing exposure for the long term
- Never expose the admin interface to the Internet: allow access only from a dedicated management network or through a bastion host.
- Phishing-resistant MFA (FIDO2, security keys) on every remote access.
- Logs streamed continuously to an external SIEM: an attacker can wipe local logs, not those already shipped.
- Monitor the CISA KEV catalog and treat its entries as top priority on exposed devices.
- Inventory your edge devices (VPNs, firewalls, gateways, remote support tools) with their exact versions: you can't patch what you don't know about.
- Consider a Zero Trust approach (ZTNA): per-application access, authenticated and checked on every request, instead of a VPN that opens up the whole network.
Checklist
- [ ] Up-to-date inventory of VPNs, gateways and remote access tools, with their versions
- [ ] Ivanti Connect Secure at 22.8R2.5 / 25.1.1.2 / 25.1.3.x or later
- [ ] BeyondTrust Remote Support / PRA with the BT26-05-RS patch
- [ ] Evidence preserved before patching, compromise assessment done
- [ ] Appliance rebuilt at the slightest doubt, secrets rotated
- [ ] Admin interfaces unreachable from the Internet
- [ ] FIDO2 MFA and logs forwarded to an external SIEM
Sources: CISA — KEV additions (October 13, 2026) · Rapid7 — BeyondTrust CVE-2026-102764 · Rapid7 — Ivanti CVE-2026-104935