A partial fix is not a fix. Ivanti has confirmed that attackers are actively exploiting a new authentication-bypass vulnerability in its Connect Secure VPN appliance, the third such zero-day to hit the product in roughly two years, and the patch released on October 13, 2026, addresses only two-thirds of the attack chain that researchers have documented. A separate privilege-escalation bug that grants root access on fully updated systems remains open, with Ivanti saying a fix is still weeks away.
A Familiar Product, A New Breach
Connect Secure, the SSL VPN appliance once sold as Pulse Connect Secure, sits at the edge of thousands of corporate, government, and university networks. That position makes it a prime target: edge devices are internet-facing by design, run vendor-specific code that outside researchers rarely get to audit closely, and can't be pulled offline without cutting off remote access for an entire organization. The product carries scar tissue from a January 2024 mass-exploitation event, when a separate flaw chain compromised appliances across dozens of government networks before any patch existed. Security teams spent the following two years working to restore confidence in the platform. CVE-2026-104935 reopens that concern, even though the scale of this incident has not been documented to match 2024's blast radius.
The newly disclosed flaw is rated 8.6 on the CVSS v3.0 scale, High severity. Its vector string, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, translates into plain terms as: an attacker needs no credentials, no user interaction, and only network access to exploit it. Ivanti describes it as an authentication-bypass-by-spoofing issue that lets an unauthenticated attacker execute commands as the appliance's low-privileged cgi-server account. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog the same day Ivanti published its advisory, citing active use for credential theft and data exfiltration.
Why the Patch Doesn't Close the Door
Incident-response firm Volexity's analysis, reported by SecurityWeek, describes the exploitation as a three-step chain rather than a single bug. The first two steps correspond to CVE-2026-104935: spoofing authentication, then executing commands with limited privileges. The third step is a distinct privilege-escalation flaw that elevates that foothold to full root access, meaning an attacker can take complete control of an otherwise fully patched appliance. Ivanti has not assigned a CVE identifier or shipped a fix for that third component, and has only said a patch is coming "over the coming weeks."
That sequencing matters for defenders. Patching to the fixed version closes the entry point Ivanti has named, but it does not guarantee the appliance is safe if an attacker already gained a foothold before the update, since the privilege-escalation step could still be used to burrow deeper. CISA's own alert language reflects that nuance: it addresses the authentication bypass and remote-code-execution risk, but stops short of declaring the full chain resolved.
- Affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
- Fixed versions: 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, depending on the branch.
- 22.7R2.14 and earlier builds are not affected by this specific CVE, per Ivanti's advisory.
- The privilege-escalation component has no published CVE or patch as of this writing.
What Security Teams Should Do Now
Ivanti's guidance, reported by BleepingComputer, urges customers to upgrade to the fixed version immediately and run the company's Integrity Checker Tool regularly. That tool was built in response to the 2024 crisis and scans appliances for signs of filesystem tampering, a step that carries extra weight here because the unresolved privilege-escalation flaw means a quiet compromise could predate public disclosure. Teams that cannot upgrade immediately should confirm their running version against the affected list, treat the upgrade as the top priority this week, run integrity scans both before and after patching, and treat any appliance with scan anomalies as compromised rather than merely vulnerable.
No source reviewed for this story, including CISA's alert or Ivanti's advisory, names specific victims, affected sectors, or the threat actor behind the exploitation. That absence of attribution leaves defenders without a clear way to cross-reference the activity against known ransomware or espionage clusters, which is why the practical advice defaults to immediate patching and assuming compromise rather than waiting for more threat intelligence to surface.
Part of a Larger Pattern
Ivanti's disclosure joins a run of high-severity, actively exploited flaws in internet-facing remote-access and messaging appliances this year, including vulnerabilities in SonicWall, Citrix NetScaler, FortiMail, and ScreenConnect, each carrying a severe CVSS score and a compressed federal patch deadline. The recurrence of this pattern, a vendor closing part of an exploit chain while a related flaw stays open, suggests that patch timelines are consistently lagging behind the moment attackers begin using a flaw in production. For organizations running Connect Secure, the lesson is that a published fix is a floor for urgency, not a ceiling for vigilance.