Ivanti shipped a partial fix for its Connect Secure VPN in July, then watched attackers walk through the unfinished part in October. On Oct. 13, 2026, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, the same day Ivanti disclosed the authentication-bypass flaw (CVSS 8.6) and admitted limited exploitation in the wild. The story that matters for admins is the gap between those two dates, and the appliance that fell inside it.
Volexity’s incident response team saw a previously unknown actor, tracked as UTA0576, take root on an appliance running 22.8R2.4, a build that counted as fully patched at the time. That detail turns a routine Ivanti Connect Secure patch cycle into a harder question: what does patched even mean when a vendor fixes a bug in pieces? Our earlier report on the three-flaw chain that grants root access covered the mechanics. This analysis focuses on the patch gap, the version map, and the Jan. 31, 2027 end-of-life date that now hangs over every 22.x deployment.
Everything below comes from Ivanti’s advisories, CISA’s alert, Volexity’s research, and press coverage dated through Oct. 23. Where a detail rests on a single report, the text says so. Where Ivanti has not said something (such as when the third flaw will get a fix), the article says that too instead of guessing.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The Short Version: What Ivanti and CISA Confirmed
Four facts anchor the whole incident. Ivanti disclosed CVE-2026-104935 on Oct. 13 as a high-severity, unauthenticated authentication-bypass vulnerability in Ivanti Connect Secure (ICS), scored 8.6 on the CVSS scale. CISA says the flaw lets a remote attacker run arbitrary commands without logging in, and it tied the exploitation to credential theft and data exfiltration. Ivanti said exploitation was limited at the time of disclosure. And CISA put the CVE on its KEV list the same day, which starts the clock for U.S. federal civilian agencies.
The affected builds are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. The fixed builds are 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. Ivanti recommends that customers upgrade immediately and run its Integrity Checker Tool regularly, alongside access restrictions, network monitoring and log review. The product keeps its name, Ivanti Connect Secure, and nothing in the record points to a rename, retirement or sale.
One more point separates this incident from a plain bug report. CVE-2026-104935 covers the authentication-bypass and remote-code-execution parts of an exploit chain. Volexity described three flaws working together, and the third one, a privilege-escalation bug, sat outside the CVE and still awaited a fix when SANS published its Oct. 16 NewsBites.
Version Map: Who Is Vulnerable and What Fixes It
Ivanti’s advisory splits the exposure across three code lines, and the fixes do not line up neatly with them. The table below condenses the advisory and the CISA alert into one view. Administrators who run more than one appliance should check each box against it instead of assuming a single upgrade covers the fleet.
| Code line | Affected builds | Fixed build | Status as of Oct. 24, 2026 |
|---|---|---|---|
| 22.7 | Not affected by this CVE (22.7.14 and earlier) | Not needed | Supported, end of life Jan. 31, 2027 |
| 22.8 | 22.8R2.4 and earlier | 22.8R2.5 | Ivanti calls it a temporary bridge to 25.1 |
| 25.1.1 | 25.1.1.1 and earlier | 25.1.1.2 | Fix listed as released Oct. 5 |
| 25.1.2 | 25.1.2.2 and earlier | 25.1.3.0 or later | Move to the 25.1.3 branch |
| 25.1.3 | Not listed as affected | 25.1.3.0, 25.1.3.1 | 25.1.3.0 shipped in July 2026 |
The 22.7 row deserves a warning label. Ivanti says 22.7.14 and earlier do not contain this particular bug, but that statement does not make those builds safe in general, and the 22.7 line shares the Jan. 31, 2027 end-of-life date. A clean result against one CVE is a thin reason to stay put.
Timeline: From the July Fix to the October Disclosure
The sequence is the real story. Ivanti says its own product-security program found part of the flaw and patched that portion in 25.1.3.0, the July 2026 release. It then began backporting the fix to other supported branches. Exploitation started before that work finished.
| Date (2026) | Event |
|---|---|
| July | Ivanti ships 25.1.3.0 with a partial fix found by its internal program |
| Oct. 1 | Defused reportedly sees the first in-the-wild exploitation (single-vendor claim) |
| Oct. 3 | Volexity dates UTA0576 exploitation to at least this day, including root on a 22.8R2.4 appliance |
| Oct. 5 | Volexity begins its investigation, and Ivanti lists 25.1.1.2 as released |
| Oct. 12 | Ivanti lists 22.8R2.5 as released |
| Oct. 13 | Ivanti disclosure, Volexity report, CISA KEV listing |
| Oct. 16 | SANS reports the privilege-escalation flaw still awaits a fix |
| Oct. 23 | Coverage still describes the third flaw as unresolved |
Two details stand out. First, Ivanti’s advisory lists fixed builds dated Oct. 5 and Oct. 12, before the public disclosure on Oct. 13. Customers who tracked release notes closely could have upgraded early, but nothing told them to hurry. Second, the exploitation window opened somewhere between Oct. 1 and Oct. 3 depending on the source, which means attackers had at least ten days of runway before the disclosure landed.
How a Fully Patched 22.8R2.4 Appliance Still Fell
The scariest line in Volexity’s write-up is the one about the victim. The appliance ran 22.8R2.4, and that was a current build when the attackers hit it. Anyone who followed Ivanti’s guidance to the letter still lost root. Ivanti now lists that same build as vulnerable and points customers to 22.8R2.5, released on October 12, 2026 as the latest confirmed 22.8 release, which superseded 22.8R2.4.
The three links in the chain
According to Volexity’s analysis, the attackers combined an authentication bypass in welcome.cgi, a file-write flaw in wu.cgi, and a privilege-escalation path through the dsinvoked broker’s handling of DSCache configuration data. Each flaw alone gives a limited foothold. Chained, they produced unauthenticated root-level code execution. Ivanti addressed the first two under CVE-2026-104935 and has not shipped a fix for the third.
What the attackers did with root
Reported post-compromise activity included credential theft, collection of Active Directory metadata, theft of appliance configuration, and capture of LDAP traffic. That list matters more than the CVSS score. An SSL VPN gateway sits on the path between users and the directory, so a rooted box hands over passwords, service-account details and a map of the internal network in one move. Defenders who patch and walk away leave those stolen secrets valid. Rotating credentials belongs in the response plan next to the upgrade.
This pattern echoes the Palo Alto PAN-OS root-access flaw we covered earlier this year, where a perimeter device again became the attacker’s first stop. Both cases reward actors who invest in a single appliance family and learn it deeply.
Ivanti’s Explanation for the Delay
Ivanti has not hidden the July history. A company spokesperson told CyberScoop: “Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle.” That reasoning is defensible on its face. Vendors triage hundreds of internal findings, and an out-of-band release for every one would train customers to ignore them.
The same spokesperson framed the chain as a mitigating factor: “Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path.” Read together, the two statements describe a bet that a partial fix plus a normal release cadence was enough. The October attacks show where the bet failed. Attackers do not respect release cycles, and they had a chain that Ivanti had not finished breaking.
In its disclosure language, as reported by The Register, Ivanti said: “We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” The company has not published a customer count, so the phrase limited number cannot be tested from outside.
Here is the uncomfortable analysis. The question is not whether Ivanti acted in good faith. It is whether a backport schedule should be allowed to trail a known-bad code path on an internet-facing gateway. Customers on 25.1.1 and 22.8 carried the exposure until the Oct. 5 and Oct. 12 builds arrived, and we found no public record that Ivanti offered interim mitigations for them in July.
The Third Flaw Is Still Open
As of the latest reporting we found, dated Oct. 23, no source confirms a fix for the privilege-escalation component. SANS NewsBites on Oct. 16 said Ivanti was working on one for a future release, and later coverage kept that description. We found no statement from Ivanti giving a date, and we will not invent one.
The practical effect is limited but real. With the authentication-bypass and file-write links patched, an attacker needs another way to reach the vulnerable privilege-escalation code, so the unauthenticated path to root is closed on fixed builds. But an attacker who lands any foothold by other means, for example through stolen administrator credentials, could still try the unpatched escalation. That is why Ivanti’s advice goes beyond upgrading. Run the Integrity Checker Tool, restrict who can reach the admin interface, watch logs, and treat any pre-patch exposure as a possible compromise.
Teams that audit appliances usually find that admin interfaces face the internet more often than anyone intended. A quick inventory using the techniques in our attack surface management walkthrough shows which of your gateways answer from the public side, and that list is the one to harden first.
The January 31, 2027 End-of-Life Clock
Ivanti’s October materials carry a second deadline. The 22.x code line reaches end of life on Jan. 31, 2027, and the company describes 22.8 as a temporary bridge from 22.7 to 25.1. In plain terms, Ivanti wants every customer on 25.x, and it is using a security emergency to say so.
That creates a decision tree for admins. If you run 22.8R2.4 or earlier, you can hop to 22.8R2.5 for an immediate fix, but that move buys about three months before the line stops receiving support. If you can go straight to 25.1.1.2 or later, you skip a second migration. Ivanti’s own documentation also lists a 25.1.4.0 release, with notes updated on Oct. 15, and reportedly adds post-quantum cryptography support and an authentication-service fallback. We could not confirm from the available record how the 25.1.4.0 build relates to the October security fixes, so check Ivanti’s advisory before treating it as the target.
- Fastest safe move for 22.8 users: install 22.8R2.5, then schedule the 25.x migration in the same change window plan.
- Cleaner move for 25.1.1 and 25.1.2 users: go to 25.1.1.2 or the 25.1.3 branch, depending on your line.
- For 22.7 users: the October bug is absent, yet the Jan. 31, 2027 end-of-life date still applies.
The deadline also reshapes buying decisions. Some shops will use the migration as a trigger to ask whether a hardware-style VPN gateway belongs in the design at all. A mesh or identity-aware approach, such as the one in our Tailscale zero-trust VPN setup guide, removes the inbound listener that attackers target, though it brings its own migration cost.
Why Edge Appliances Keep Losing This Race
Ivanti is not alone this month. Its own Patch Tuesday write-up lists a string of edge and gateway problems, and the numbers set the backdrop. According to Ivanti’s vulnerability knowledge base, 2026 CVE disclosures had already passed the full-year 2025 total by 64% as of Oct. 12, and exploited vulnerabilities ran 33% above 2025’s full-year count. Microsoft alone fixed more than 1,400 CVEs in its October release, as we covered in our Patch Tuesday breakdown.
Edge devices suffer for structural reasons. They face the internet by design, they run custom firmware that outside researchers rarely audit, and they often cannot host an endpoint detection agent. When a chain like this one reaches root, the defender’s usual tooling sees nothing. The only reliable signals come from the vendor’s integrity checker, network telemetry, and the logs of systems the appliance talks to, such as domain controllers.
Competitive Comparison: Ivanti Against Other Edge Vendors in October
The table compares the main edge-device flaws that Ivanti’s October write-up and our own coverage tracked. It is not a ranking of vendor quality. It shows how crowded the perimeter threat list became in a single month.
| Vendor and product | CVE | CVSS | Flaw type | Reported state |
|---|---|---|---|---|
| Ivanti Connect Secure | CVE-2026-104935 | 8.6 | Authentication bypass, command execution | On CISA KEV, exploited since early October |
| Citrix NetScaler | CVE-2026-88779 | 8.7 | Targeted zero-day, SAML configuration required | Disclosed by Citrix |
| Fortinet FortiMail | CVE-2026-104286 | 9.8 | Unauthenticated file write | Flagged exploited by CISA |
| SonicWall SMA1000 | CVE-2026-102255 | 10.0 | Pre-authentication SSRF | Hotfixed Oct. 6, attack traffic by Oct. 9, compromise unconfirmed |
Ivanti’s CVSS score is the lowest in the table, yet its real-world impact is arguably the highest because the chain reached root on a patched box. Scores measure a single bug in isolation. They miss what happens when a vendor leaves one link of a chain unfixed. For readers following the neighbors, we covered the Citrix NetScaler zero-days and their CISA deadline and the FortiMail zero-day that landed on the KEV list in separate pieces.
Market Impact: Budgets, Contracts and Trust
Nobody has published a customer-loss figure for Ivanti, and we will not estimate one. What the record does show is behavior that tends to follow an event like this. Federal agencies work to a KEV deadline (reportedly Oct. 16 for civilian agencies, which has already passed). Enterprises ask their MSPs for fleet inventories. Insurers ask whether internet-facing VPN gateways run supported builds. Singapore’s Cyber Security Agency also issued an alert on active exploitation of the CVE, which signals that regulators outside the U.S. treat it as a live threat.
Procurement teams will probably push three changes. They will ask vendors for written backport timelines, they will ask for interim mitigations when a fix is partial, and they will weigh end-of-life dates more heavily in renewals. Vulnerability-management vendors benefit from this mood because every incident lifts demand for asset visibility, a theme we examined in our Tenable, Qualys and Rapid7 comparison. Ivanti’s own business faces the opposite pressure: on Oct. 20 the company appointed Robert Ruelas as Chief Revenue Officer to lead global sales and renewals and promoted Sterling Parker to Chief Customer Officer to oversee customer success, adoption, retention, and advocacy, and a Fall 2026 G2 report named its endpoint management product a leader on Oct. 22, but neither news item answers the trust question for the VPN line.
What Admins Should Do This Week
This checklist draws on Ivanti’s advisory and CISA’s alert. Work through it in order, because the early steps limit damage while the later ones close the hole.
- List every Connect Secure appliance and its build. Anything at 22.8R2.4 or earlier, 25.1.1.1 or earlier, or 25.1.2.2 or earlier is exposed.
- Upgrade to a fixed build: 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1, depending on the line.
- Run the Integrity Checker Tool and keep running it on a schedule.
- Assume exposure since at least Oct. 1 for unpatched boxes and hunt for the reported behavior: credential theft, Active Directory queries and LDAP traffic capture.
- Rotate credentials that passed through the appliance, including service accounts bound to LDAP.
- Restrict the admin interface to a management network and review authentication logs.
- Put the 25.x migration on the calendar well before Jan. 31, 2027.
If an integrity check fails or logs show unexplained admin sessions, treat the box as compromised. That means isolating it, preserving evidence, rebuilding from known-good media and rotating every secret it held. A patch applied after compromise does not evict an attacker who already has root.
Historical Context: A Gateway With a Long Target History
Third-party coverage notes that Ivanti Connect Secure descends from the product once sold as Pulse Connect Secure, which is why older write-ups still use that name. We found no evidence of a rename or retirement in October 2026. What the lineage tells us is that this gateway family has drawn attacker attention across several generations of ownership and branding, and that the pattern is a property of the product category more than of any single release.
The 2026 version of the pattern has one new twist. Earlier incidents often turned on a single bug that a vendor patched after a public scramble. This one turned on timing and partial remediation across code lines. Defenders can now cite it when they argue that a vendor’s internal fix does not equal customer protection until the fix ships to the branch the customer actually runs. That also echoes the GlobalProtect ransomware case where the patch was five months old, in which attackers won because defenders lagged, whereas here the vendor’s own schedule gave attackers the lead.
Five Predictions for the Next 90 Days
These are analyst judgments, not reported facts, and the first four carry real uncertainty.
- Ivanti ships a fix for the privilege-escalation flaw. The company has said it is working on one, and a public chain with an open link is hard to leave alone. The exact release vehicle is unknown.
- More exploitation reports appear. Ivanti described the exploitation as limited at disclosure. Public technical detail from Volexity lowers the bar for copycats, so expect additional actors to test unpatched appliances.
- The Jan. 31, 2027 date drives upgrades. Admins who patch to 22.8R2.5 will find the support runway short and will likely move to 25.x in the first quarter.
- Buyers demand backport commitments. RFPs for VPN gateways will start to include written timelines for fixes across supported branches.
- The KEV catalog keeps adding edge devices. Four perimeter products appear in this month’s table alone, and nothing in the data suggests that stops.
Frequently Asked Questions
What is CVE-2026-104935?
It is a high-severity authentication-bypass vulnerability in Ivanti Connect Secure with a CVSS score of 8.6. Ivanti disclosed it on Oct. 13, 2026, and CISA says it lets a remote, unauthenticated attacker run arbitrary commands.
Which Ivanti Connect Secure versions are affected?
Builds 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. The fixed builds are 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
Was a fully patched appliance really compromised?
Yes. Volexity reported root-level access on an appliance running 22.8R2.4, which was the current build for that line when the attack occurred. Ivanti now lists 22.8R2.4 as affected.
Is the whole exploit chain fixed?
Not according to the reporting we found. The authentication-bypass and remote-code-execution parts have fixes. The privilege-escalation flaw was still awaiting a fix in coverage dated through Oct. 23.
When did the attacks start?
Volexity dates UTA0576 exploitation to at least Oct. 3. Defused reportedly saw exploitation on Oct. 1, but that date rests on one vendor’s claim.
What happens on January 31, 2027?
Ivanti has scheduled the 22.x code line to reach end of life on that date and recommends moving to 25.x. Ivanti describes 22.8 as a bridge between 22.7 and 25.1.
Should we switch away from an SSL VPN gateway?
That depends on your architecture and staffing. Patch first, then evaluate whether an identity-aware or mesh design would shrink your internet-facing surface. Our cybersecurity coverage hub tracks the vendor options as they evolve.
