A critical weakness in Ivanti Connect Secure is already being used against real customers, not just sitting in a lab report. Ivanti disclosed on October 13, 2026 that attackers can bypass authentication entirely and run commands on vulnerable systems without ever logging in. The company says exploitation has so far affected a limited number of customers, but the flaw's nature means any unpatched system facing the internet is a potential target.
What the Vulnerability Actually Does
Tracked as CVE-2026-104935, the bug carries a CVSS score of 8.6 and is classified under CWE-290, authentication bypass by spoofing. In plain terms, the appliance can be tricked into believing a request is legitimate when it is not, letting an outsider skip the login step altogether. Ivanti's own assessment notes low attack complexity and no requirement for credentials or user interaction, which is precisely what makes remote-access gateways like Connect Secure such attractive targets: they sit at the edge of corporate networks by design, handling authentication for remote employees, and a flaw in that gatekeeping function can open a direct path inward. The CVSS breakdown shows the heaviest damage lands on data confidentiality, with comparatively smaller effects on integrity and availability - consistent with an attacker who can read sensitive information and execute commands but does not necessarily have a straightforward way to take the system fully offline.
A Patch That Arrived Before the Attack Was Noticed
Ivanti says its security team found part of this issue earlier in the year and shipped a fix in version 25.1.3.0, released in July 2026. The exploitation now being reported happened while the company was still extending that fix to other supported branches - a reminder that vulnerability remediation across a sprawling product line rarely moves at a single pace. Ivanti credited the security research firm Volexity with helping identify and contain the threat to affected customers. The company has stressed that this incident involves a distinct vulnerability from the Ivanti VPN flaws exploited in earlier years, including the breach at MITRE, and should not be read as evidence that the same techniques are in play here.
Who Needs to Act, and How Quickly
The affected releases are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Versions 22.7 and below are not affected. Ivanti has published fixed builds for each supported branch:
- 25.1.1.1 users on ISA6000 or ISA8000 appliances should move to 25.1.1.2.
- 22.8 deployments should upgrade to 25.1.1.2 or later, or apply 22.8R2.5 as an interim step.
- Customers able to migrate fully should move to 25.1.3.0 or 25.1.3.1.
Migrating to 25.1.3.0 is not a simple software update for every customer - it requires the newer ISA4500, ISA6500, or ISA8500 hardware platforms. Physical appliances need new units, while virtual and cloud instances must be rebuilt from updated templates rather than patched in place. That raises the practical bar for organizations still running older infrastructure, and it adds urgency given that both the 22.7 and 22.8 branches reach end of life on January 31, 2027, after which they will receive no further security updates at all.
Unanswered Questions and the Broader Pattern
Ivanti says it currently has no reliable indicators of compromise to share, which limits how effectively defenders can hunt for signs of past intrusion on their own systems. Organizations that suspect they were targeted are directed to the company's recovery guidance rather than a published detection signature. The advisory does not name the attackers or describe the exploitation method in technical depth, leaving open how far the campaign extends beyond the customers Ivanti has already confirmed. Edge devices such as VPN gateways have become a recurring weak point across the industry precisely because they combine internet exposure with privileged network access - a combination that makes each new disclosure in this product category worth treating as urgent rather than routine.