A patch that fixes two-thirds of a problem is not a fix. That is the uncomfortable reality facing Ivanti customers this month, as the company confronts its third actively exploited Connect Secure zero-day in roughly two years, and the one update it has shipped does not fully close the attack chain attackers are using against it.
On October 13, 2026, Ivanti published an advisory for CVE-2026-104935, an authentication-bypass flaw in its Connect Secure SSL VPN appliance. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day, stating that threat actors are already using it for credential theft and data exfiltration. The flaw carries a CVSS score of 8.6, meaning a remote attacker needs no credentials and no user interaction to exploit it. Incident-response firm Volexity, in analysis reported by SecurityWeek, found something more troubling underneath the official severity rating: the patched flaw is only two steps of a three-step chain, and the third step, a privilege-escalation bug that grants root access on fully updated appliances, remains unaddressed.
A Familiar Wound Reopens
Connect Secure, formerly sold as Pulse Connect Secure, has a difficult history. In January 2024, a chain of flaws in the product fueled a mass-exploitation crisis that compromised appliances across dozens of government networks before fixes existed, forcing emergency federal directives and, in some cases, outright disconnection of affected devices. Security teams spent the better part of two years rebuilding confidence in the platform. This new disclosure does not approach that earlier crisis in documented scale, but it follows a similar script: an internet-facing remote-access device, a vendor racing to patch after exploitation begins, and a gap between what is fixed and what is actually safe.
According to reporting from The Hacker News, Ivanti identified part of the underlying issue during an internal security review earlier this year and moved to patch it only after detecting exploitation in the wild. Volexity's technical account describes the full attack as three linked steps: an attacker spoofs authentication, executes commands as the low-privileged cgi-server account, and then uses a separate, still-unpatched privilege-escalation flaw to climb from that limited foothold to full root access. Ivanti has not assigned a CVE number to that third step, and the company has said only that a fix is coming "over the coming weeks."
Why the Gap Matters
CISA's alert is carefully worded to cover only the authentication bypass and remote-code-execution risk tied to CVE-2026-104935. It does not claim the attack chain is closed. Organizations that apply Ivanti's patch shut the door attackers were originally using to get in, but they remain exposed to the privilege-escalation step if an attacker already has a foothold on an appliance, patched or not. That distinction matters enormously for incident response: a system can be fully updated according to the vendor's advisory and still be vulnerable to a quiet escalation from a prior, undetected compromise.
Ivanti's advisory lists 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier as affected branches, with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. The 22.7R2.14 branch is reported as unaffected by this specific CVE. Ivanti recommends that customers upgrade immediately and run the company's Integrity Checker Tool, built in response to the 2024 crisis, to scan for filesystem tampering that could indicate an earlier, undetected breach.
- Confirm the running version against Ivanti's affected list before assuming safety
- Prioritize the upgrade over other patch work this week, given the KEV listing
- Run integrity scans both before and after upgrading
- Treat any appliance with scan anomalies as compromised, not merely vulnerable
A Pattern Across the Network Edge
No source reviewed for this story names specific victims or sectors, and neither CISA nor Volexity has attributed the campaign to a known threat actor. That absence of attribution leaves defenders without a way to cross-reference the activity against familiar ransomware affiliates or espionage groups, which narrows the practical advice to a blunt instruction: patch now, and assume compromise rather than wait for more context.
This disclosure also fits a broader pattern visible across 2026. SonicWall's appliances, Citrix NetScaler, Fortinet's FortiMail, and ScreenConnect have each seen high-severity, actively exploited flaws land on CISA's KEV list this year, often with compressed, multi-day patch deadlines rather than the standard multi-week cycle. These products share a common vulnerability: they sit at the network edge by design, run vendor-proprietary code that is harder to audit than mainstream server software, and cannot be taken offline without disrupting remote access for an entire organization. That combination makes them the first target for both ransomware crews and espionage operations, and it means the gap between a CVSS score and a CISA KEV listing keeps closing faster than vendors can ship complete fixes.