A patch that was supposed to close a dangerous hole in Ivanti Connect Secure has left part of the lock mechanism broken. On October 13, 2026, Ivanti disclosed CVE-2026-104935, an authentication-bypass vulnerability in its widely deployed SSL VPN appliance, after CISA confirmed attackers were already using it for credential theft and data exfiltration. The complication, according to incident-response firm Volexity, is that the fix covers only two of three linked flaws in a chain that, left intact, can hand an attacker full root access on appliances that administrators believe are fully updated.
A Partial Fix for a Three-Part Problem
CVE-2026-104935 carries a CVSS score of 8.6, high severity, and requires no credentials or user interaction to exploit remotely. Ivanti and outside researchers describe it as an authentication-bypass-by-spoofing issue that lets an unauthenticated attacker run commands on the appliance using a low-privileged account. That alone is serious. What makes it worse, per Volexity's analysis reported by SecurityWeek, is that this CVE represents only the first two steps of a three-step attack chain. The third step, a separate privilege-escalation bug that elevates limited access to full root control, has no assigned CVE number and no published patch. Ivanti says a fix is coming "over the coming weeks," which leaves a real window during which an attacker who gains the initial foothold can still take over a fully patched device.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day Ivanti's advisory went public, triggering a compressed remediation deadline for federal civilian agencies rather than the usual multi-week cycle. Neither CISA nor Volexity has named the threat actor behind the exploitation, and no victim organizations or sectors have been publicly identified. The absence of attribution matters practically: without it, defenders cannot cross-reference the activity against known ransomware affiliates or espionage groups, so the operating assumption has to be patch immediately and treat any exposed appliance as potentially already compromised.
Why Edge Appliances Keep Becoming the Entry Point
Connect Secure sits at the network edge by design, the exact position that makes VPN gateways attractive to attackers. These devices run vendor-proprietary code that is harder for outside researchers to audit than mainstream server software, and they typically cannot be taken offline without cutting off remote access for an entire workforce, which discourages rapid isolation even after a vulnerability becomes public. Ivanti's product has been here before. A mass-exploitation crisis in January 2024 compromised appliances across dozens of government networks before patches existed, forcing emergency disconnections and consuming much of the following two years in remediation and trust-rebuilding.
This year's disclosure fits a broader pattern across the industry rather than standing apart from it. High-severity, actively exploited flaws have also hit SonicWall appliances, Citrix NetScaler, FortiMail, and remote-management tools like ScreenConnect, each landing in CISA's KEV catalog with a short patch deadline attached. The common thread is structural: internet-facing remote-access software, a high CVSS score, and attackers already inside before a fix ships. That sequencing, patch timelines lagging real-world exploitation, is a recurring feature of edge-device security rather than an isolated failure.
What Organizations Running Connect Secure Should Do Now
Ivanti's advisory lists three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 depending on the branch. Builds on 22.7R2.14 and earlier are not affected by this particular CVE, though Ivanti still recommends general security hygiene for those older releases.
- Confirm the exact running version against Ivanti's affected list before assuming you are covered.
- Prioritize the upgrade over other patch work this week, given the compressed KEV deadline.
- Run Ivanti's Integrity Checker Tool before and after upgrading to detect filesystem tampering tied to a prior breach.
- Treat any appliance with scan anomalies as compromised, not merely vulnerable, since the unpatched privilege-escalation flaw means a quiet intrusion could predate public disclosure.
Because CISA's directive technically binds only federal civilian agencies, private-sector operators in sectors that mirror government exposure, universities, healthcare systems, and critical-infrastructure providers, should treat the federal timeline as a minimum standard rather than a ceiling. The deeper lesson from this disclosure is less about one vendor's advisory and more about how attack chains now outpace single-vulnerability patching: closing one door in a three-door chain still leaves defenders exposed until the vendor finishes the job.