A patch that was supposed to close a dangerous hole in Ivanti Connect Secure has instead left one-third of an active attack chain wide open. On October 13, 2026, Ivanti disclosed CVE-2026-104935, an authentication-bypass vulnerability that CISA says is already being used for credential theft and data exfiltration, and the agency added it to its Known Exploited Vulnerabilities catalog the same day. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the fix addresses only two of three linked flaws attackers are chaining together, leaving a privilege-escalation bug that grants root access on fully updated appliances unresolved.
A Familiar Appliance, an Unfamiliar Kind of Gap
Connect Secure, the SSL VPN product formerly sold as Pulse Connect Secure, sits at the network edge of thousands of enterprises, government agencies, and universities. That positioning makes it attractive to attackers for a simple reason: edge devices are internet-facing by design, run vendor-proprietary code that outside researchers rarely get to audit closely, and can't be taken offline without cutting off remote access for an entire workforce. CVE-2026-104935 carries a CVSS v3.0 score of 8.6, rated High, with a vector indicating that a remote attacker needs no credentials and no user interaction to exploit it. Ivanti describes the underlying issue as authentication bypass by spoofing, allowing an unauthenticated attacker to execute commands as the low-privileged cgi-server account.
What distinguishes this disclosure from a routine patch cycle is the sequencing. Volexity's technical write-up frames the exploitation as a three-step chain: the first two steps, covered by CVE-2026-104935, spoof authentication and grant limited command execution. The third step, a separate privilege-escalation flaw that has not yet received a CVE number or a fix, elevates that limited shell to full root access. Ivanti has told researchers a patch for that third component is coming "over the coming weeks," which means organizations that upgrade now close the entry point but remain exposed to escalation if an attacker already has a foothold.
What CISA's Listing Does and Doesn't Cover
CISA's Known Exploited Vulnerabilities listing is scoped specifically to the authentication bypass and remote-code-execution risk in CVE-2026-104935, and the agency's alert does not claim the broader attack chain is resolved. A KEV entry triggers a binding operational directive for federal civilian agencies, typically with a short remediation deadline once active exploitation is confirmed; the compressed window here reflects how urgently CISA views the threat rather than any confidence that the underlying appliance is now fully secured. No threat actor has been publicly named, and none of the sources reviewed, including Ivanti's advisory and reporting from SecurityWeek and The Hacker News, identify specific victims or sectors. CISA's description of observed activity, limited to credential theft and data exfiltration, suggests reconnaissance rather than destructive action, but that assessment could shift as more incident responders report findings.
Ivanti's advisory lists three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 depending on the branch. The 22.7R2.14 branch and earlier is not affected by this particular CVE, according to Ivanti, though the company still recommends general security hygiene for those older releases.
Why This Keeps Happening
This is Connect Secure's third actively exploited zero-day in roughly two years, following the January 2024 mass-exploitation crisis that forced several federal agencies to disconnect appliances outright and triggered emergency directives. That episode was documented at a scale this new disclosure has not yet reached, but the structural pattern is the same: a vendor ships a partial fix while a related flaw stays open, and defenders are left managing residual risk rather than a clean resolution. The Integrity Checker Tool Ivanti built after 2024 remains the most practical safeguard available now, since it can flag filesystem tampering that might indicate a compromise predating this week's disclosure.
This disclosure also joins a broader run of high-severity, actively exploited flaws in internet-facing remote-access tools this year, including SonicWall SMA appliances, Citrix NetScaler, Fortinet FortiMail, and ScreenConnect, each tied to a CISA KEV entry and a compressed patch window. For security teams, the practical response is unchanged regardless of vendor: confirm the running version against the affected list, prioritize the upgrade immediately, run integrity scans before and after patching, and treat any appliance with scan anomalies as compromised rather than merely vulnerable.