Ivanti has confirmed that attackers are actively exploiting a newly disclosed authentication-bypass vulnerability in its Connect Secure VPN appliance, and the fix the company shipped on October 13, 2026 covers only part of the problem. CISA added the flaw, tracked as CVE-2026-104935, to its Known Exploited Vulnerabilities catalog the same day, citing credential theft and data exfiltration already underway. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the patched bug is just two steps of a three-step attack chain, and the third step, a privilege-escalation flaw that grants root access, remains unfixed.
A Partial Fix for a Full Attack Chain
CVE-2026-104935 carries a CVSS score of 8.6, meaning a remote attacker needs no credentials and no user interaction to exploit it. Ivanti describes it as an authentication-bypass-by-spoofing issue that lets an unauthenticated attacker run commands as the appliance's low-privileged cgi-server account. That alone is dangerous for a device sitting at the network edge. But Volexity's technical breakdown shows attackers pairing that access with a separate, still-unpatched privilege-escalation bug to jump from a limited shell to full root control, even on appliances running the latest patched version. Ivanti has not assigned a CVE number to that third flaw and says a fix is coming "over the coming weeks," leaving a window during which a fully updated system can still be pushed to complete compromise.
The affected branches include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti has released 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 as fixes for the named CVE. Older 22.7R2.14 builds are not affected by this particular flaw, according to the advisory, though Ivanti still recommends following standard security guidance for those releases.
Why Edge Devices Keep Becoming the Entry Point
Connect Secure sits at the perimeter of thousands of enterprise, government, and university networks, which is exactly the profile that ransomware operators and espionage groups look for first: internet-facing, difficult to take offline without disrupting remote work, and running vendor-proprietary code that outside researchers rarely get to audit closely. This is not Ivanti's first brush with mass exploitation. A chain of Connect Secure flaws in January 2024 compromised appliances across government networks before patches existed, forcing emergency directives and, in some cases, outright disconnection of affected systems. That episode was far larger in documented scope than what has been confirmed so far for CVE-2026-104935, but the structural resemblance is clear: a vendor patch that closes one door while another stays ajar.
The same pattern has played out repeatedly in 2026 across other remote-access and messaging appliances, including flaws in SonicWall, Citrix NetScaler, FortiMail, and ScreenConnect, each landing in CISA's KEV catalog with a compressed patch deadline rather than the standard multi-week cycle. Five high-severity, actively exploited edge-device vulnerabilities in a single year is not coincidental. It reflects where attackers are concentrating their effort: devices built to sit outside the corporate firewall, which makes them both essential and exposed by design.
What Security Teams Should Do Now
CISA's alert does not name a specific threat actor, and Volexity's published analysis stops short of attribution as well, which means defenders cannot easily cross-reference this activity against known ransomware or espionage clusters. The practical guidance defaults to patching immediately and assuming compromise rather than waiting for more threat-intelligence context.
- Confirm your running Connect Secure version against the affected branches and upgrade without delay.
- Run Ivanti's Integrity Checker Tool before and after upgrading to detect filesystem tampering from a prior breach.
- Treat any appliance flagged by the integrity scan as compromised, not merely vulnerable.
- Monitor for Ivanti's forthcoming patch addressing the unnamed privilege-escalation flaw, since the current fix does not close the full attack chain.
Organizations that share infrastructure patterns with federal agencies, including universities, healthcare systems, and critical-infrastructure operators, should treat CISA's remediation timeline as a minimum rather than a deadline to meet exactly. Until Ivanti patches the third link in the chain, a fully updated Connect Secure appliance is safer than an outdated one, but it is not provably closed to the attackers already probing it.