A patch that was supposed to close an actively exploited hole in Ivanti Connect Secure has left a second, undisclosed vulnerability wide open, allowing attackers to escalate from a limited foothold to full root access on appliances that administrators believe are fully updated. CISA added the flaw, tracked as CVE-2026-104935, to its Known Exploited Vulnerabilities catalog on October 13, 2026, the same day Ivanti published its advisory. For the thousands of organizations running Connect Secure at the edge of their networks, the fix that just shipped addresses only part of the problem.
A Three-Step Chain, Only Two Steps Closed
According to analysis from incident-response firm Volexity, reported by SecurityWeek, the attack unfolds in three stages rather than one. The first two map to CVE-2026-104935: an unauthenticated attacker spoofs authentication and then executes commands as the low-privileged cgi-server account. That alone would be serious but containable. The third stage is a separate privilege-escalation bug, not yet assigned its own CVE number, that elevates that limited shell into root access on the appliance. Ivanti has not published a fix for that third component and has told reporters it plans to address it "over the coming weeks." Until then, an appliance running the newly patched version can still be driven to full compromise if an attacker already has a way in.
CVE-2026-104935 itself carries a CVSS v3.0 score of 8.6, High severity. The vector string, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, describes a flaw reachable remotely, requiring no credentials and no user interaction, with a high-impact breach of confidentiality and more limited damage to data integrity and availability. CISA says it is aware of attackers already using the bug for credential theft and data exfiltration, which points to reconnaissance and intelligence-gathering rather than immediate disruption, though that assessment could shift as more incident responders report findings.
Why Edge Appliances Keep Becoming the Entry Point
Connect Secure, the SSL VPN product formerly sold as Pulse Connect Secure, sits at the network edge by design, the exact position that makes it valuable to attackers and difficult to defend. It runs vendor-proprietary code that is harder for outside researchers to audit than mainstream server software, and it generally cannot be taken offline without cutting off remote access for an entire workforce. Those constraints have made edge appliances, from VPN gateways to secure-email relays, one of the most consistently targeted categories of enterprise technology in 2026. Ivanti's product has a difficult history here: a chain of flaws discovered in January 2024 led to mass exploitation across government and private networks before patches existed, forcing emergency disconnections and a long rebuilding of trust. CVE-2026-104935 does not appear to have reached that scale, but the underlying pattern, a partial fix shipped while attackers are already active, is the same one defenders are seeing across other vendors' edge products this year, including SonicWall, Citrix, and Fortinet appliances that each drew CISA KEV listings and compressed federal patch deadlines.
What Organizations Running Connect Secure Should Do Now
Ivanti's advisory lists three affected branches: 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, with fixes available in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5 depending on which branch an organization runs. Builds on 22.7R2.14 and earlier are not affected by this specific CVE, according to Ivanti, though the company still recommends general security hygiene for those older releases.
- Confirm your running version against Ivanti's affected list and prioritize the upgrade this week over other patch work.
- Run Ivanti's Integrity Checker Tool, built after the 2024 incident, both before and after upgrading to catch signs of prior filesystem tampering.
- Treat any appliance that returns scan anomalies as compromised, not merely vulnerable, given that the unpatched privilege-escalation flaw could allow a quiet breach predating public disclosure.
- Track Ivanti's forthcoming advisory for the third, unnamed flaw in the chain, since patching CVE-2026-104935 alone does not close the full attack path.
Because CISA's KEV listing imposes a short remediation window on federal civilian agencies, private-sector operators in similarly exposed sectors, universities, healthcare systems, and critical-infrastructure providers, should treat that same compressed timeline as a minimum standard rather than a government-specific rule. Neither CISA nor Ivanti has named a threat actor behind the exploitation, which leaves defenders without the usual shortcut of matching activity to a known ransomware affiliate or espionage group. In the absence of that context, the only reliable posture is to patch immediately and assume compromise until integrity scans prove otherwise.