A patch that was supposed to close a dangerous hole in Ivanti Connect Secure has instead left a back stairwell open. On October 13, 2026, Ivanti disclosed CVE-2026-104935, an authentication-bypass vulnerability in its widely deployed SSL VPN appliance, and CISA added it to its Known Exploited Vulnerabilities catalog the same day. But according to incident-response firm Volexity, the fix addresses only two-thirds of a three-step attack chain, leaving a privilege-escalation bug that grants root access on fully updated systems unresolved.
A Familiar Pattern, a New Twist
Connect Secure, the product once sold as Pulse Connect Secure, has a troubled recent history. In January 2024, a chain of flaws in the platform triggered a mass-exploitation crisis that hit government networks hard enough to force emergency disconnections and federal directives. Security teams spent the better part of two years rebuilding confidence in the product. This disclosure reopens that wound, not because the scale matches 2024, but because the underlying failure mode looks the same: attackers operating inside the network before a fix exists.
CVE-2026-104935 carries a CVSS score of 8.6, rated High severity. The vector string shows a remote attacker needs no credentials and no user interaction to exploit it, producing a serious confidentiality breach alongside more limited damage to data integrity and system availability. Ivanti and outside researchers describe it as an authentication-bypass-by-spoofing flaw that lets an unauthenticated attacker run commands on the appliance as a low-privileged account.
Why the Fix Isn't the Whole Fix
Volexity's technical analysis, reported by SecurityWeek and The Hacker News, frames the real danger as a three-step chain rather than a single bug. The first two steps map directly to CVE-2026-104935: spoofing authentication, then executing commands under a restricted account. The third step is a separate, still-unpatched privilege-escalation flaw that turns that limited foothold into full root access. Ivanti has not assigned that third vulnerability a CVE number, and the company has said only that a fix is coming "over the coming weeks." Until then, an appliance running the latest patch is safer than before, but not fully closed to an attacker who already has a way in.
That nuance shapes CISA's own language carefully. The agency's alert confirms active exploitation of the authentication bypass for credential theft and data exfiltration, but it does not claim the attack chain is fully neutralized. Organizations that patch have removed one entry point; they have not necessarily removed all of them.
What Organizations Should Do Now
Ivanti's advisory lists three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, with fixes available in versions 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Builds on the 22.7R2.14 line and earlier are not affected by this particular flaw, though Ivanti still recommends following standard security hygiene for those releases.
- Confirm your running version against the affected list and prioritize the upgrade immediately.
- Run Ivanti's Integrity Checker Tool before and after patching, since it can detect filesystem tampering tied to the unpatched third flaw.
- Treat any appliance flagged by a scan as compromised, not merely vulnerable, and investigate accordingly.
- Track the CISA KEV catalog directly, since federal timelines for this entry are compressed given active exploitation.
No source reviewed for this story names specific victims or sectors, and CISA has not attributed the activity to a known threat actor. That absence of attribution matters practically: without it, defenders cannot cross-reference the campaign against known ransomware or espionage clusters, which pushes the sensible posture toward patching now and assuming compromise rather than waiting for more context.
An Edge-Device Problem, Not an Isolated One
This disclosure lands amid a string of similar incidents in 2026 involving internet-facing remote-access and messaging appliances, including high-severity, actively exploited flaws in other VPN and email gateway products. Each case follows a comparable arc: a device sitting outside the corporate firewall by design, running vendor-proprietary code that is harder to audit than mainstream server software, and discovered under active attack before a complete fix exists. Connect Secure's latest chapter fits that pattern closely enough that security teams are beginning to treat "edge device zero-day" less as an exceptional event and more as a recurring category of risk that demands standing readiness rather than one-time response.