A patch that was supposed to close an actively exploited hole in Ivanti Connect Secure has left attackers one step away from full control of fully updated appliances. On October 13, 2026, Ivanti disclosed CVE-2026-104935, an authentication-bypass vulnerability that CISA says is already being used for credential theft and data exfiltration, and added it to the Known Exploited Vulnerabilities catalog the same day. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the published fix addresses only two-thirds of a three-step attack chain, with a separate privilege-escalation flaw that grants root access still unresolved.
A Chain, Not a Single Bug
CVE-2026-104935 is rated 8.6 on the CVSS v3.0 scale, high severity, exploitable remotely without credentials or user interaction. Ivanti describes it as an authentication-bypass-by-spoofing issue that lets an unauthenticated attacker execute commands as the low-privileged cgi-server account. On its own, that would be a serious but contained foothold. Volexity's technical write-up shows why it isn't: the spoofing and command execution are steps one and two of a three-stage chain, and step three, a separate privilege-escalation bug, elevates that limited shell into root access on a fully patched system. Ivanti has not assigned a CVE number or shipped a fix for that third flaw, saying only that a patch is coming "over the coming weeks." Until then, an attacker who gains the initial foothold can still climb to full appliance takeover, even on systems running the latest build.
Why the Edge Keeps Getting Hit
Connect Secure, formerly sold as Pulse Connect Secure, sits at the network edge of thousands of enterprises, agencies, and universities, exactly the kind of internet-facing device that ransomware crews and espionage operators prioritize. The product was at the center of a mass-exploitation crisis in January 2024, when a separate chain of flaws let attackers compromise appliances across government networks before patches existed. Security teams spent the following two years rebuilding confidence in the platform; this disclosure reopens that wound, even though nothing in current reporting suggests a blast radius comparable to 2024. Ivanti says it discovered part of the underlying issue during an internal review earlier this year and moved to patch once exploitation was detected in the wild, a sequence that again put defenders behind attackers on the clock.
The pattern extends well beyond Ivanti. This year alone has brought a CVSS 10.0 flaw in SonicWall appliances, Citrix NetScaler zero-days that blew past a CISA remediation deadline, a FortiMail bug that forced a three-day federal patch window, and a critical ScreenConnect vulnerability with its own compressed KEV deadline. Each involves an internet-facing remote-access or messaging product, a high severity score, and confirmed exploitation before or shortly after disclosure. These are devices built to sit outside the corporate firewall, running vendor-proprietary code that is harder to audit than mainstream server software, and rarely taken offline because doing so disrupts remote access for an entire workforce.
What Organizations Can Actually Do
Ivanti's affected branches are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 depending on the branch. Builds on 22.7R2.14 and earlier are not affected by this particular CVE, though Ivanti still recommends following general security guidance for those releases.
- Confirm the running version against the affected list and prioritize the upgrade this week.
- Run Ivanti's Integrity Checker Tool before and after upgrading, since the unpatched privilege-escalation flaw means a quiet compromise could predate public disclosure.
- Treat any appliance with scan anomalies as compromised, not merely vulnerable.
- Track the still-unnamed privilege-escalation CVE closely and apply that patch as soon as Ivanti releases it.
Neither CISA nor Volexity has attributed the exploitation to a named threat actor, which limits how precisely defenders can cross-reference the activity against known ransomware or espionage clusters. That gap pushes the practical advice toward patching immediately and assuming compromise rather than waiting for threat-intelligence context. CISA's KEV listing imposes a binding, compressed deadline on federal civilian agencies, but universities, healthcare systems, and critical-infrastructure operators that share the same exposure profile would do well to treat that timeline as a minimum, not a target.
