Ivanti is dealing with its third actively exploited Connect Secure zero-day in roughly two years, and this time the fix doesn’t fully close the door. On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, an authentication-bypass flaw in Connect Secure that CISA says attackers are already using for credential theft and data exfiltration. The twist, according to incident-response firm Volexity’s analysis reported by SecurityWeek, is that the one CVE Ivanti patched is only two-thirds of a three-flaw chain. A separate privilege-escalation bug that hands attackers root access on fully updated appliances remains unfixed.
That gap matters because Connect Secure sits at the network edge of thousands of enterprises, government agencies, and universities, exactly the kind of exposed, internet-facing device that ransomware crews and espionage groups have learned to hunt first. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog the same day Ivanti disclosed it, a sign of how urgently the agency views active exploitation of edge VPN infrastructure in late 2026.
A Third Zero-Day in Two Years Hits Ivanti Connect Secure
Ivanti Connect Secure, the SSL VPN appliance formerly sold as Pulse Connect Secure, has had a rough run. The product was at the center of a mass-exploitation crisis in January 2024, when a chain of flaws let attackers compromise appliances across dozens of government networks before patches existed. Security teams spent much of 2024 and 2025 rebuilding trust in the platform. CVE-2026-104935 reopens that wound. According to reporting from The Hacker News, Ivanti discovered part of the underlying issue during an internal security review earlier this year, then moved to patch it once exploitation was detected in the wild.
The timing lands Ivanti in an uncomfortable spot alongside a run of other edge-device vulnerabilities disclosed this year. Shattered.io has already covered how SonicWall’s CVSS 10.0 flaw drew active attacks, how Citrix NetScaler zero-days blew past a CISA deadline, and how a FortiMail zero-day forced a three-day federal patch window. Ivanti’s disclosure fits the same pattern: an internet-facing remote-access product, a high CVSS score, and attackers already inside before the fix shipped.
Inside CVE-2026-104935: The Authentication Bypass Explained
CVE-2026-104935 is rated 8.6 on the CVSS v3.0 scale, High severity, with a vector string of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. In plain terms, that means a remote attacker needs no credentials and no user interaction to exploit it, and a successful attack produces a high-impact breach of confidentiality alongside limited damage to data integrity and availability. Ivanti and the outlets that reviewed the advisory describe the flaw as an authentication-bypass-by-spoofing issue that allows an unauthenticated attacker to execute arbitrary commands on the appliance.
What makes the bug dangerous isn’t just the bypass itself. CVE-2026-104935 is Ivanti’s umbrella identifier covering two linked problems: the authentication bypass and a remote-code-execution component that together let an attacker run commands as the low-privileged cgi-server account. On its own, that’s a serious but contained foothold. Paired with the still-unpatched third flaw, it becomes something closer to full appliance takeover.
Volexity’s Chain: Two Patched Flaws, One Root-Access Gap
Volexity’s technical write-up, cited by both SecurityWeek and The Hacker News, lays out the attack as a three-step chain rather than a single bug. Step one and two map to CVE-2026-104935: the attacker spoofs authentication and executes commands as cgi-server. Step three is a separate privilege-escalation vulnerability that elevates that limited shell access to root. Ivanti has not assigned a CVE number or published a fix for that third step as of this writing. SecurityWeek reported that Ivanti plans to address it “over the coming weeks,” leaving a window during which patched appliances can still be pushed to full compromise if an attacker already has a foothold.
That sequencing explains why CISA’s language is carefully scoped. The agency’s alert addresses the authentication bypass and remote-code-execution risk covered by CVE-2026-104935, but it doesn’t claim the full attack chain is resolved. Organizations that patch to the fixed branches close off the entry point Ivanti has named, but they are relying on the attacker not already having a way in through the still-open privilege-escalation gap.
CISA Adds the Flaw to Its Known Exploited Vulnerabilities Catalog
CISA listed CVE-2026-104935 in its KEV catalog on October 13, 2026, the same day Ivanti’s advisory went public. The agency’s alert states that it is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. KEV listings trigger a binding operational directive for federal civilian agencies, which are typically given a short remediation window once a flaw lands in the catalog; CISA’s own reporting on this entry points to a compressed, multi-day patch deadline rather than the standard multi-week cycle, reflecting how actively the bug is already being used.
Unlike some recent KEV entries, CISA has not publicly named the threat actor behind the exploitation, and Volexity’s published analysis likewise stops short of attributing the campaign to a specific group. That’s a meaningful gap for defenders: without actor attribution, security teams can’t easily cross-reference the activity against known ransomware affiliates or espionage clusters, so the practical advice defaults to patch now and assume compromise rather than wait for threat-intel context.
No Confirmed Victim List Yet
None of the sources reviewed for this story, including CISA’s alert, Ivanti’s advisory, or the SecurityWeek and Hacker News write-ups, name specific victim organizations or industry sectors. CISA’s description of observed activity, limited to credential theft and data exfiltration, suggests attackers are using the access for reconnaissance and data theft rather than immediate destructive action, but that could change as more incident responders report in over the coming weeks.
Which Ivanti Connect Secure Versions Are Affected
Ivanti’s advisory names three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The company says 22.7R2.14 and earlier builds are not affected by this particular CVE, though it still recommends following general product-security guidance for those older releases. Fixed versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, depending on which branch an organization runs.
Affected and Patched Connect Secure Branches
| Branch | Affected Version | Patched Version | Status |
|---|---|---|---|
| 25.1.1.x | 25.1.1.1 and earlier | 25.1.1.2 | Fixed for CVE-2026-104935 |
| 25.1.2.x / 25.1.3.x | 25.1.2.2 and earlier | 25.1.3.0 or 25.1.3.1 | Fixed for CVE-2026-104935 |
| 22.8R2.x | 22.8R2.4 and earlier | 22.8R2.5 | Fixed for CVE-2026-104935 |
| 22.7R2.x | 22.7R2.14 and earlier | N/A | Not affected by this CVE, per Ivanti’s advisory |
| Privilege-escalation flaw (unnamed CVE) | All branches in the chain | No patch published yet | Unpatched at time of reporting; Ivanti says a fix is coming “over the coming weeks” |
What Ivanti and CISA Are Telling Customers to Do Right Now
Ivanti’s guidance, as reported by BleepingComputer, tells customers to review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly. That tool, which Ivanti built in response to the 2024 incident, scans appliances for signs of filesystem tampering that could indicate a prior compromise, something that matters here because the unpatched privilege-escalation flaw means a quiet breach could predate the public disclosure.
For teams that can’t upgrade immediately, the practical checklist looks like this: confirm your running version against the affected list, prioritize the upgrade window over other patch work this week, run integrity scans before and after upgrading, and treat any appliance that shows scan anomalies as compromised rather than merely vulnerable. Because the KEV listing applies immediate pressure on federal agencies, private-sector security teams that share infrastructure patterns with government networks, universities, healthcare systems, and critical-infrastructure operators, should treat the same timeline as a floor, not a ceiling.
# Defensive check: cross-reference your patch tracker against the CISA KEV feed
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
| jq '.vulnerabilities[] | select(.cveID=="CVE-2026-104935")'Echoes of 2024: Ivanti’s Troubled VPN Security History
Security teams who lived through January 2024 will recognize the shape of this story even if the details differ. That earlier crisis involved a chain of Connect Secure flaws exploited before patches were available, hitting government agencies and private networks broadly enough that CISA issued emergency directives and several federal bodies had to disconnect appliances outright. The scale, duration, and confirmed victim count from that episode were extensively documented at the time; this new disclosure has not reached that level of documented detail yet, and nothing in the current reporting establishes a comparable blast radius for CVE-2026-104935.
What is comparable is the structural pattern: a vendor patches part of an exploit chain while a related flaw stays open, and defenders are left managing partial risk reduction rather than a clean fix. That pattern isn’t unique to Ivanti. It shows up across the broader category of CVSS-to-KEV tracking that shattered.io examined in its look at the gap between CVSS severity scores and CISA’s actual exploited-vulnerability list, where patch timelines consistently lag the point at which attackers start using a flaw in production.
2026’s Run of Edge-Appliance Zero-Days
Ivanti’s disclosure is the latest in a string of high-severity, actively exploited flaws in internet-facing remote-access and messaging appliances this year. The pattern is consistent enough that security teams are starting to treat “edge device zero-day” as a recurring category of incident rather than an isolated event.
| Vendor / Product | CVSS Score | CISA KEV Status | Notes |
|---|---|---|---|
| Ivanti Connect Secure (CVE-2026-104935) | 8.6 | Added Oct. 13, 2026 | Third flaw in attack chain remains unpatched |
| SonicWall SMA appliances | 10.0 | Reported under active attack | Covered previously on this site |
| Citrix NetScaler | 9.5 | KEV listed; CISA deadline passed | Covered previously on this site |
| Fortinet FortiMail | 9.8 | KEV listed; 3-day federal deadline | Covered previously on this site |
| ScreenConnect | 9.9 | KEV listed; 3-day CISA deadline | Covered previously on this site |
Five high-severity, actively exploited edge-device flaws in a single year, each tied to a CISA KEV entry and a compressed patch window, is not a coincidence of reporting. It reflects where attackers are concentrating effort: devices that sit outside the corporate firewall by design, run vendor-proprietary code that’s harder to audit than mainstream server software, and often can’t be taken offline without disrupting remote access for an entire workforce.
Why Remote-Access Appliances Keep Becoming Attack Chains
VPN concentrators and secure-access gateways occupy a uniquely exposed position in enterprise networks. They have to accept connections from the open internet, they often run with elevated privileges to manage tunneling and authentication, and they are frequently excluded from the same patch cadence as general-purpose servers because taking one offline cuts off remote access for everyone behind it. That combination, internet-facing, high-privilege, patch-averse, is exactly the profile attackers look for when hunting for an initial-access foothold.
Ivanti’s situation adds a second layer to that problem. Even organizations that patch promptly are still exposed to the unresolved privilege-escalation step in the chain, because fixing the entry point doesn’t retroactively undo an attacker’s prior access if they got in before the patch landed. That’s why Ivanti’s advice to run integrity-checking tools, rather than simply trusting the patch, is the more important instruction in the advisory for any organization that was running an affected branch before October 13.
Market Fallout: Can Enterprise VPN Vendors Rebuild Trust
For Ivanti, the business risk is reputational as much as technical. Enterprise security buyers already factored a 2024 crisis into their vendor-risk assessments, and a third disclosure in roughly two years gives procurement and security teams a harder conversation to have at renewal time. That doesn’t mean customers switch overnight, VPN appliance migrations are expensive and slow, but it does accelerate budget conversations toward zero-trust network access platforms that reduce reliance on a single internet-facing gateway.
Competing secure-access vendors stand to benefit from exactly this kind of headline, regardless of whether their own products carry comparable risk. Every edge-appliance zero-day disclosed this year, Ivanti’s, SonicWall’s, Citrix’s, has fed the same market argument: concentrating remote access through one hardware or virtual appliance creates a single high-value target, and that target is getting hit often enough that insurance underwriters and compliance auditors are starting to ask pointed questions about remote-access architecture during renewal cycles.
The Zero Trust Alternative Gains Ground
The practical alternative gaining traction is zero-trust network access (ZTNA), which replaces a single VPN concentrator with per-application, identity-verified connections that don’t expose a monolithic appliance to the open internet in the first place. ZTNA isn’t a silver bullet, it shifts risk to identity providers and policy engines rather than eliminating it, but it does remove the specific failure mode Ivanti customers are facing this week: a single appliance whose compromise grants broad network access.
The tension for most enterprises is migration cost and timeline. Moving off an entrenched VPN platform touches every remote worker’s daily access, every third-party integration, and often multi-year hardware contracts. Security teams know the architectural argument for ZTNA; what keeps legacy VPN appliances in place is budget cycles and the operational disruption of a cutover, not disagreement about the risk.
What Happens Next: Five Predictions
- Ivanti will likely assign a dedicated CVE and ship a patch for the privilege-escalation flaw within weeks, consistent with the “coming weeks” timeline SecurityWeek reported, rather than leaving it open indefinitely given the active-exploitation pressure.
- Expect additional incident-response vendors beyond Volexity to publish their own telemetry on exploitation volume and, potentially, actor attribution, once more customers report compromises.
- CISA’s KEV entry will likely be updated or supplemented with a second entry once the third flaw receives its own CVE and patch, mirroring how multi-flaw chains have been handled in prior KEV cycles.
- Enterprise security budgets for 2027 planning cycles will show increased line items for ZTNA pilots specifically citing this disclosure and the preceding 2024 incident as justification.
- Ivanti will face renewed scrutiny from enterprise customers and analysts over its secure-development lifecycle for Connect Secure, given this is the third significant disclosure in roughly two years for the same product line.
Frequently Asked Questions
What is CVE-2026-104935?
It’s an authentication-bypass vulnerability in Ivanti Connect Secure, rated 8.6 on the CVSS v3.0 scale, that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. Ivanti disclosed it and CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026.
Which Ivanti Connect Secure versions are affected?
Versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier are affected. Ivanti says 22.7R2.14 and earlier builds are not affected by this specific CVE.
Is CVE-2026-104935 being actively exploited?
Yes. CISA states it is aware of threat actors exploiting the flaw for credential theft and data exfiltration. No specific threat actor or APT group has been publicly named in connection with the exploitation as of this reporting.
Does patching CVE-2026-104935 fully fix the problem?
No. Security firm Volexity’s analysis describes a three-flaw attack chain. Patching CVE-2026-104935 closes the authentication-bypass and remote-code-execution entry point, but a separate privilege-escalation flaw that grants root access had not received a published fix as of October 13-14, 2026.
How does this compare to the 2024 Ivanti Connect Secure crisis?
The 2024 incident involved a chain of flaws exploited before patches existed, affecting government and private networks broadly enough to trigger emergency federal directives. The current disclosure follows a similar pattern of chained vulnerabilities, but available reporting does not establish a comparable confirmed victim count or scale for the 2026 flaw yet.
What should IT teams do right now?
Upgrade affected Connect Secure appliances to the patched versions (25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5, depending on branch), run Ivanti’s Integrity Checker Tool to look for signs of prior compromise, and treat the CISA KEV listing’s short remediation window as a priority deadline even outside federal agencies.
Is there a CISA deadline for patching this flaw?
CISA added CVE-2026-104935 to its KEV catalog on October 13, 2026, which triggers a binding remediation requirement for federal civilian agencies on a compressed timeline. Private-sector organizations running the affected product are strongly encouraged to follow the same urgency.
Should enterprises move away from VPN appliances entirely?
Not necessarily overnight, but this disclosure adds to a 2026 pattern of edge-appliance zero-days that is pushing more security teams to evaluate zero-trust network access as a longer-term replacement for single-point VPN concentrators, even as migration cost and operational disruption keep most organizations on existing platforms for now.
