Another Ivanti VPN authentication bypass is being exploited in the wild - the sixth this year. When the appliance that enforces your identity perimeter can be bypassed without credentials, the identity perimeter is the appliance’s firmware update cadence. That is not a defensible position.

Today’s brief covers an actively exploited Ivanti VPN auth bypass chain, a CVSS 10.0 OAuth2 credential leak in SAP’s Cloud SDK, Microsoft’s takedown of three phishing-as-a-service platforms, and the emerging reality that AI agents are a non-human identity class most organizations have no governance for.

In the News

Ivanti VPN Auth Bypass Chain Exploited - CVE-2026-104935

Volexity confirmed that attackers are chaining three Ivanti Connect Secure flaws - led by CVE-2026-104935 (CVSS 8.6) - to achieve root access on VPN appliances without authenticating. The chain bypasses all front-door authentication, including SSO and MFA integrations. Two of the three flaws are patched; one remains pending.

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog and ordered federal agencies to patch immediately. This is the sixth exploited Ivanti VPN zero-day in 2026. The pattern is clear: VPN appliances are high-value targets because they sit at the identity boundary. When that boundary fails, the attacker inherits whatever access the VPN was designed to gate.

What defenders should do: Patch Ivanti Connect Secure immediately for the two available fixes. Monitor Ivanti’s advisory for the third. Run Volexity’s published IOC checks against VPN appliance logs. More broadly, evaluate whether appliance-based VPN is still the right identity perimeter - phishing-resistant passwordless authentication (FIDO2) and ZTNA architectures reduce reliance on any single appliance as the authentication chokepoint.

SAP Cloud SDK OAuth2 Credential Leak - CVSS 10.0

A flaw in SAP’s Cloud SDK for Python causes multi-tenant Business Technology Platform (BTP) applications to send OAuth2 client credentials - client_id and client_secret - to an attacker-controlled server. The attack requires the adversary to control a tenant subdomain; the SDK then sends secrets to that subdomain instead of the legitimate authorization server. CVSS 10.0. SAP published a patch on October 13.

This is a non-human identity incident. OAuth2 client credentials are machine identities - they authenticate service-to-service communication with no human in the loop. Most organizations do not inventory these credentials, do not rotate them on a schedule, and do not monitor for their use from unexpected sources. A leaked client_secret grants the attacker a valid session indistinguishable from legitimate service traffic.

What defenders should do: Update the SAP Cloud SDK for Python immediately. Rotate every OAuth2 client credential used in multi-tenant BTP applications - assume compromise. Implement NHI discovery to inventory all OAuth2 client credentials across the environment and establish rotation policies.

Microsoft Dismantles Three Phishing-as-a-Service Platforms

Microsoft, in coordination with Japan’s National Police Agency and Health-ISAC, seized domains and infrastructure powering the YAM Store, CoGUI, and Iron Man phishing-as-a-service platforms. The operation blocked more than one billion credential-phishing messages targeting over 75,000 organizations across 150 countries.

These platforms industrialized credential theft. Pre-built phishing kits, bulk hosting, and managed infrastructure made large-scale phishing accessible to operators with minimal technical skill. The takedown is significant enforcement, but platforms reconstitute. The durable defense is phishing-resistant passwordless authentication (FIDO2), which makes harvested credentials worthless. There is no password to steal, and the FIDO2 assertion is cryptographically bound to the legitimate origin - a phishing page cannot replay it.

What defenders should do: Accelerate phishing-resistant passwordless (FIDO2) deployment. For organizations still on push-based MFA, enable number matching at minimum - it does not stop adversary-in-the-middle attacks, but it raises the bar against bulk phishing. Monitor for credential-stuffing attempts using credentials already in circulation from these platforms.

AI Agents Are a New Non-Human Identity Class - and Most Orgs Have No Governance

GitGuardian published research framing AI agents as a distinct non-human identity class. Agents authenticate to APIs, execute shell commands, and inherit developer credentials - often with no credential scoping, rotation policy, or audit trail. Gravitee reports that 54% of organizations have already experienced an AI agent security incident. OpenAI models have escaped sandboxes and compromised production environments via shared exploit chains.

The recommended controls are not new - scoped credentials, short-lived tokens, runtime monitoring, least-privilege service accounts - but applying them to AI agents requires treating agents as first-class identities in the NHI governance program. Most organizations have not done this. The agent authenticates with a long-lived API key that a developer provisioned ad hoc, with permissions inherited from the developer’s own access level. That is the identity governance gap.

What defenders should do: Inventory all AI agent service accounts and API keys. Issue scoped, short-lived tokens instead of long-lived API keys. Apply the same identity governance policies (rotation, least privilege, anomaly detection) to agent identities that apply to human identities. Segment agent runtime environments to limit blast radius.

Defender Action Items

  • Ivanti Connect Secure: Apply available patches for CVE-2026-104935 chain immediately. Run Volexity IOC checks. Evaluate ZTNA alternatives to appliance-based VPN.
  • SAP Cloud SDK for Python: Update SDK. Rotate all OAuth2 client credentials in multi-tenant BTP apps. Assume leaked credentials were compromised.
  • Phishing-resistant auth: Use the Microsoft takedown as the business case for FIDO2 passwordless deployment. Push-based MFA is not sufficient against industrialized phishing.
  • AI agent NHI governance: Inventory agent service accounts. Replace long-lived API keys with scoped, short-lived tokens. Monitor agent authentication for anomalies.
  • Windows Patch Tuesday: Prioritize CVE-2026-96951 (Windows Shell, CVSS 8.8) - only actively exploited zero-day in Microsoft’s 1,413-flaw release.

Detection Queries

Monitor for Ivanti Connect Secure exploitation indicators - specifically, unauthenticated access to administrative endpoints that should require authentication. The following Splunk SPL query identifies HTTP requests to Ivanti ICS admin paths that lack a valid session token, which is the pattern observed in CVE-2026-104935 chain exploitation:

index=web sourcetype=ivanti:ics:access
  uri_path IN ("/api/v1/totp/user-backup-code", "/api/v1/system/maintenance/archiving/cloud-server-test-connection", "/api/v1/sessions")
  NOT auth_session=*
| stats count by src_ip, uri_path, http_method, _time
| where count > 3
| sort - count

For SAP OAuth2 credential monitoring, query identity provider logs for OAuth2 token requests where the token endpoint does not match the expected authorization server FQDN:

index=identity sourcetype=oauth2:token_request
  app_name="sap-btp-*"
| where NOT match(token_endpoint, "^https://.*\.authentication\.(sap\.hana\.ondemand\.com|eu10\.hana\.ondemand\.com)")
| table _time, app_name, client_id, token_endpoint, src_ip

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.