A patch that fixes two-thirds of a problem is not a patch. That is the uncomfortable reality Ivanti customers face after the company's October 13, 2026 disclosure of CVE-2026-104935, an authentication-bypass vulnerability in Connect Secure that CISA says attackers are already exploiting for credential theft and data exfiltration. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the patched flaw is only part of a three-step attack chain. The final step, a privilege-escalation bug that grants root access on fully updated appliances, remains unfixed.
A Familiar Appliance, A New Crack
Connect Secure, the SSL VPN product formerly sold as Pulse Connect Secure, occupies a sensitive position in enterprise networks: the edge, where internal systems meet the open internet. That position made it the center of a mass-exploitation crisis in January 2024, when a separate chain of flaws let attackers compromise appliances across government networks before fixes existed. Security teams spent much of the following two years rebuilding confidence in the platform. This disclosure reopens that concern, not because of scale, since no victim count or sector breakdown has been confirmed, but because of the pattern. According to The Hacker News, Ivanti found part of the underlying issue during an internal review earlier this year and moved to patch it only after exploitation was detected in the wild.
CVE-2026-104935 carries a CVSS score of 8.6, High severity. The vector string, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, means a remote attacker needs no credentials and no user interaction, and a successful exploit produces a high-impact breach of confidentiality. In practice, Ivanti describes it as an authentication-bypass-by-spoofing flaw that lets an unauthenticated attacker execute commands as the low-privileged cgi-server account. That alone is a serious foothold. Chained with the still-unpatched privilege-escalation step Volexity documented, it becomes a path to full root access, even on appliances running the latest fixed version.
Why the Fix Isn't the End of the Story
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day Ivanti's advisory went public, triggering a binding operational directive with a compressed remediation deadline for federal civilian agencies. But the agency's language is carefully scoped to the bypass and remote-code-execution risk Ivanti has actually named. Nothing in CISA's alert, or in Ivanti's own advisory, claims the full attack chain is closed. SecurityWeek reported that Ivanti plans to address the third, unnamed privilege-escalation flaw "over the coming weeks," leaving a window in which an attacker who already has a foothold can still escalate to root on a patched system.
No threat actor has been publicly named in connection with the exploitation, and Volexity's analysis does not attribute the campaign to a specific group. That absence matters for defenders: without a known actor to cross-reference against ransomware affiliates or espionage clusters, the practical guidance collapses to a simpler instruction, patch immediately and assume compromise rather than wait for threat-intelligence context to arrive.
What Organizations Running Connect Secure Should Do Now
Ivanti's advisory names three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 respectively. The 22.7R2.14 branch is not affected by this specific CVE, though Ivanti still recommends following general security guidance for it. As reported by BleepingComputer, Ivanti is telling customers to upgrade immediately and run the Integrity Checker Tool, built in response to the 2024 incident, to scan for filesystem tampering that could indicate a prior breach.
- Confirm your running version against Ivanti's affected list before assuming you are safe
- Prioritize the Connect Secure upgrade above other patch work this week
- Run integrity scans both before and after upgrading
- Treat any appliance with scan anomalies as compromised, not merely vulnerable
- Track Ivanti's advisory for the still-unreleased fix to the privilege-escalation flaw
A Pattern Beyond One Vendor
This disclosure lands alongside a run of other high-severity, actively exploited flaws in internet-facing remote-access appliances this year, including vulnerabilities in SonicWall, Citrix NetScaler, and FortiMail products, each tied to a CISA KEV listing and a compressed patch window. The common thread is structural: these are vendor-proprietary systems sitting outside the corporate firewall by design, harder to audit than mainstream server software, and difficult to take offline without disrupting remote access for an entire workforce. A vendor patching part of an exploit chain while a related flaw stays open is not an isolated failure. It reflects how patch timelines, even urgent ones, consistently lag the point at which attackers begin using a flaw in production.