A patch that closes one door while leaving another ajar is arguably worse than no patch at all, because it creates false confidence. That is the situation Ivanti customers face after the company's October 13, 2026 disclosure of CVE-2026-104935, an authentication-bypass vulnerability in Connect Secure that CISA says is already being exploited for credential theft and data exfiltration. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the single CVE Ivanti patched addresses only two of three steps in an attack chain that ends with full root access on fully updated appliances.
A Familiar Vendor, a Recurring Crisis
Connect Secure, the SSL VPN product once sold as Pulse Connect Secure, has now absorbed three actively exploited zero-days in roughly two years. The most damaging came in January 2024, when a chain of flaws let attackers compromise appliances across government and private networks before fixes existed, forcing emergency federal directives and, in some cases, outright disconnection of affected devices. Security teams spent much of 2024 and 2025 rebuilding confidence in the platform. This latest advisory reopens that wound, even though nothing in current reporting suggests a blast radius comparable to the 2024 episode.
According to The Hacker News, Ivanti found part of the underlying issue during an internal security review earlier this year and moved to patch it once exploitation was detected in the wild. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day the advisory went public, triggering a compressed remediation window for federal civilian agencies rather than the standard multi-week cycle.
Why a Fixed Appliance Still Isn't Safe
CVE-2026-104935 carries a CVSS score of 8.6, with a vector indicating that a remote attacker needs no credentials and no user interaction to exploit it. The flaw is actually an umbrella identifier covering two linked problems: an authentication bypass achieved through spoofing, and a remote-code-execution component that lets an attacker run commands as the low-privileged cgi-server account. Ivanti's fix closes both of those entry points.
What it doesn't close is the third step in the chain Volexity documented: a separate, still-unnamed privilege-escalation vulnerability that turns that limited cgi-server foothold into full root access. Ivanti has not assigned a CVE number or shipped a fix for that flaw, telling SecurityWeek a patch is coming "over the coming weeks." Until then, an attacker who already has a foothold on a patched appliance can still escalate to complete control.
- Affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier
- Fixed versions: 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, depending on branch
- 22.7R2.14 and earlier builds are not affected by this specific CVE, per Ivanti
- The privilege-escalation component of the chain remains unpatched across all branches
What Defenders Should Actually Do
Ivanti's guidance, as reported by BleepingComputer, urges customers to upgrade to a fixed version immediately and run the Integrity Checker Tool regularly. That tool, built after the 2024 crisis, scans appliances for filesystem tampering that could signal a prior breach, a precaution that matters precisely because the open privilege-escalation gap means a quiet compromise could predate public disclosure entirely. Patching alone doesn't guarantee a clean appliance if an intrusion already occurred.
The practical sequence for security teams is straightforward: confirm your running version against the affected list, treat the upgrade as this week's top priority, run integrity scans before and after patching, and treat any appliance with scan anomalies as compromised rather than merely vulnerable. Because CISA's KEV listing applies binding pressure on federal agencies, organizations in healthcare, higher education, and critical infrastructure should treat that same deadline as a minimum standard, not a comfortable ceiling.
Part of a Larger Pattern at the Network Edge
CISA has not named a threat actor behind the exploitation, and Volexity's published analysis stops short of attribution, leaving defenders without a clear link to known ransomware affiliates or espionage groups. The default posture, absent that context, is to patch now and assume compromise.
Ivanti's disclosure also fits a broader pattern this year across internet-facing remote-access and messaging appliances. SonicWall, Citrix NetScaler, FortiMail, and ScreenConnect have each produced high-severity, actively exploited flaws tied to KEV listings and compressed federal patch windows. These products share structural traits that make them attractive targets: they sit outside the corporate firewall by design, run vendor-proprietary code that resists outside auditing, and can rarely be taken offline without disrupting remote access for an entire organization. Until that structural exposure changes, edge devices will likely keep generating this kind of partial-fix, race-against-exploitation story.