A patch that fixes two-thirds of a problem is not a fix. That is the uncomfortable reality facing Ivanti customers this month, as the company works through its third actively exploited Connect Secure zero-day in roughly two years, and this time the remediation it shipped does not close the full attack path. On October 13, 2026, Ivanti published an advisory for CVE-2026-104935, an authentication-bypass flaw that CISA says is already being used for credential theft and data exfiltration. Incident-response firm Volexity's analysis, reported by SecurityWeek, found that the single CVE Ivanti addressed covers only two steps of a three-step chain. The third step, a privilege-escalation bug that grants root access on fully updated appliances, remains unpatched.
A Familiar Wound Reopens
Connect Secure, the SSL VPN appliance once sold as Pulse Connect Secure, has a troubled recent history. In January 2024, a chain of flaws in the product let attackers compromise appliances across dozens of government networks before fixes existed, forcing emergency directives and, in some cases, outright disconnection of devices. Security teams spent the following two years rebuilding confidence in the platform. This new disclosure does not approach that earlier episode's documented scale, but it follows the same structural pattern: a vendor pushing a partial fix while attackers already have a working path inside. According to The Hacker News, Ivanti found part of the underlying issue during an internal review earlier this year and moved to patch once exploitation was detected in the wild, rather than before.
How the Chain Actually Works
CVE-2026-104935 carries a CVSS v3.0 score of 8.6, with a vector indicating that a remote attacker needs no credentials and no user interaction to exploit it. Ivanti describes it as an authentication-bypass-by-spoofing issue, paired with a remote-code-execution component that lets an attacker run commands as the appliance's low-privileged cgi-server account. That alone is a serious foothold. Volexity's technical write-up frames the full attack as three sequential steps: spoofing authentication, executing commands as cgi-server, and then exploiting a separate, still-unnamed privilege-escalation flaw to reach root. Ivanti has not assigned that third flaw a CVE number or published a fix, saying only that one is coming "over the coming weeks." Until then, a patched appliance closes the entry point but not the exit to full control, which is exactly why CISA's own language carefully limits its claims to the authentication-bypass component it has confirmed.
What Organizations Can Actually Do Now
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog the same day Ivanti disclosed it, triggering a compressed remediation deadline for federal civilian agencies rather than the standard multi-week cycle. Neither CISA nor Ivanti has named the threat actor behind the activity, which leaves defenders without the usual shortcut of matching behavior to a known group. The practical response is straightforward even without that context:
- Confirm your running version against the affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
- Upgrade to the fixed releases, 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5, depending on your branch, as the immediate priority this week.
- Run Ivanti's Integrity Checker Tool before and after upgrading, since the unpatched privilege-escalation flaw means a quiet compromise could predate public disclosure.
- Treat any appliance with scan anomalies as compromised, not merely vulnerable, and escalate accordingly.
Part of a Larger Pattern at the Network Edge
Ivanti's disclosure joins a run of high-severity, actively exploited flaws in internet-facing remote-access products this year, including a maximum-severity SonicWall bug, Citrix NetScaler zero-days that outran a CISA deadline, and a FortiMail flaw that forced a three-day federal patch window. The common thread is structural, not coincidental: these are devices that sit outside the corporate firewall by design, run vendor-specific code that is harder to audit than mainstream server software, and cannot be taken offline without cutting off remote access for an entire workforce. That combination makes them the preferred first target for both ransomware crews and espionage operators, and it means the gap between a CVSS score and a CISA KEV listing keeps shrinking. For defenders, the lesson of 2026 so far is blunt: assume the fix you just installed is necessary, but do not assume it is sufficient.