A patch that closes two-thirds of an attack chain is not a fix - it is a delay. That is the uncomfortable reality facing Ivanti customers this month, as the company's third actively exploited Connect Secure zero-day in roughly two years turns out to be part of a larger problem it has not yet solved. CISA added the new flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalog on October 13, 2026, the same day Ivanti published its advisory, citing ongoing credential theft and data exfiltration against appliances in active use.
A Familiar Vendor, a Recurring Crisis
Connect Secure, the SSL VPN product formerly branded Pulse Connect Secure, occupies a sensitive position in enterprise networks: it sits at the edge, facing the open internet, brokering remote access for employees, contractors, and government staff. That position made it the center of a mass-exploitation crisis in January 2024, when a separate chain of flaws let attackers compromise appliances across government and private networks before fixes existed. Security teams spent the following two years rebuilding confidence in the platform. This new disclosure reopens that anxiety, even if its scope has not been documented at the same scale.
According to incident-response firm Volexity, whose analysis was reported by SecurityWeek, CVE-2026-104935 is not a single bug but Ivanti's umbrella label for two linked issues: an authentication bypass that lets an unauthenticated attacker spoof legitimate access, and a command-execution flaw that lets that attacker run commands under a low-privileged service account. Rated 8.6 on the CVSS v3.0 scale, the flaw requires no credentials and no user interaction, which is precisely what makes it attractive to opportunistic attackers scanning the internet for exposed appliances.
The Unpatched Third Step
What distinguishes this incident from a routine high-severity bug is the missing piece. Volexity's research describes the real-world attack as a three-step chain: the first two steps correspond to the newly patched CVE, giving an intruder limited shell access. The third step is a separate privilege-escalation vulnerability, still without a CVE number or a public patch, that elevates that limited foothold to full root access on the appliance. Ivanti has said a fix is coming "over the coming weeks," which means organizations that apply the current patch close the front door while a side door, already demonstrated in the wild, remains open to anyone who gets in first.
CISA's alert reflects that distinction carefully. The agency's language addresses the authentication bypass and remote-code-execution risk tied to the published CVE, but it stops short of claiming the full attack chain has been resolved. For federal civilian agencies, the KEV listing triggers a binding remediation deadline measured in days rather than weeks, underscoring how urgently the government views exploitation of edge VPN infrastructure. Neither CISA nor Volexity has named the group behind the exploitation, which means defenders cannot yet cross-reference the activity against known ransomware or espionage operations and must default to patching immediately rather than waiting for threat-intelligence context.
What Organizations Running Connect Secure Should Do Now
Ivanti's advisory lists three affected branches - 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier - with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 depending on the branch in use. Builds on 22.7R2.14 and earlier are not affected by this particular flaw, though Ivanti still recommends following general security guidance for those older releases.
- Confirm the running version against Ivanti's affected list and prioritize the upgrade above other patch work this week.
- Run Ivanti's Integrity Checker Tool, built after the 2024 incident, both before and after upgrading to detect filesystem tampering.
- Treat any appliance that returns scan anomalies as compromised, not merely vulnerable, given that the unpatched privilege-escalation flaw could allow a quiet breach predating public disclosure.
- Track Ivanti's forthcoming advisory for the third, unnamed CVE, since patching today does not close the full chain Volexity documented.
This episode fits a broader pattern visible across edge-device security this year, from SonicWall's maximum-severity flaw to Citrix NetScaler and FortiMail zero-days that each forced compressed federal patch windows. These products sit outside the traditional firewall perimeter by design, run vendor-specific code that is harder to audit than mainstream server software, and cannot be taken offline without disrupting remote access for entire organizations. That combination has made remote-access appliances one of the most consistently targeted categories of infrastructure in recent memory, and Ivanti's partial fix is a reminder that a patch announcement does not always mean the threat has passed.