Attackers are exploiting a critical authentication bypass in Ivanti Connect Secure VPN appliances, granting remote access to corporate networks without a single password or credential. The flaw, tracked as CVE-2026-104935 and rated 8.6 out of 10 on the CVSS severity scale, has already compromised a number of organizations and now carries a government-imposed deadline for emergency patching.
How the Bypass Works
The vulnerability is classified as an authentication bypass through spoofing, a category of flaw in which the system is tricked into treating an unverified request as legitimate. In practical terms, an attacker can impersonate a trusted process or session and gain entry to the appliance's management functions, then execute arbitrary commands on the device. Because Connect Secure appliances typically sit at the edge of a corporate network, controlling remote access for employees, compromising one effectively hands an intruder a foothold inside the internal network itself - no phishing, no stolen password, no multi-factor prompt required.
Security firm Volexity first detected exploitation activity in early October 2026, and Ivanti confirmed the attacks on October 13, acknowledging that "a limited number of customers" had been affected before the issue became public. Notably, Ivanti's own product security team had partially identified the flaw earlier, which led to a partial fix shipping quietly in the July 2026 release, version 25.1.3.0. Attackers moved while the company was still in the process of backporting that fix to older, still-supported branches - a timing gap that is becoming a recurring theme in edge-device security incidents.
Who Is Affected and What to Patch
The flaw affects a defined range of versions, while earlier releases remain untouched by this particular issue:
- Affected: ICS 25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier
- Not affected: versions 22.7.x and below
- Patched: 25.1.1.2, 25.1.3.1, and 22.8R2.5
Complicating matters, Volexity found that attackers are chaining this authentication bypass with a separate privilege escalation vulnerability that remains unpatched. Ivanti has said a fix for that second flaw is forthcoming, which means organizations applying today's patch close one door while a related one stays open. Reliable indicators of compromise from Ivanti itself are not yet available, but Volexity has published its own indicators on GitHub, giving defenders a starting point for threat hunting even in the absence of official guidance.
Why Edge Devices Keep Becoming the Target
VPN gateways and similar remote-access appliances occupy a uniquely sensitive position in enterprise networks. They are internet-facing by design, they handle authentication for an entire organization, and they often run specialized software that receives less scrutiny than mainstream operating systems. That combination makes them a preferred target for well-resourced attackers, including state-linked groups, who can gain broad network access through a single exploited device rather than compromising individual employee accounts one at a time. Ivanti's VPN products specifically have faced repeated zero-day exploitation over the past two years, a pattern that has pushed some security teams to question whether perimeter VPN appliances should remain the default model for remote access at all, as opposed to newer zero-trust architectures that limit what any single compromised component can reach.
Federal agencies in the United States face an October 16 deadline to apply the available patches, underscoring how seriously government cybersecurity authorities are treating the threat. Security researchers are urging all organizations, not just federal entities, to treat this as an emergency update rather than something to fold into a routine patch cycle. Equally important is the recommendation that administrators actively hunt for signs of prior compromise, since attackers had an exploitation window before fixes became available and may already be present inside affected networks, patch or no patch.