In brief
Ivanti Connect Secure is the remote-access gateway many companies use to let staff into the office network from home. In October, Ivanti confirmed that attackers had broken into some customers' gateways through a flaw that wasn't yet fixed for every version. Then, on October 30, two more Ivanti flaws were added to the US government's list of vulnerabilities under active attack. If your organisation runs Connect Secure, this one needs today, not next patch Tuesday.
What happened?
On October 13, 2026, Ivanti published an advisory for CVE-2026-104935, a way to get past the gateway's login. According to Rapid7's summary, the flaw allows a remote, unauthenticated attacker to execute arbitrary commands. In plain terms: someone on the internet, with no password, could make your front door run their instructions.
It was already being used. Ivanti reported that exploitation had occurred before disclosure, affecting a limited number of customers. CISA added it to its Known Exploited Vulnerabilities catalog on the same day as Ivanti's disclosure.
A race Ivanti lost
The timeline is the uncomfortable part. Ivanti says part of the problem was found by its own security team and fixed in its July release. But exploitation occurred while Ivanti was working to backport the fix to older supported versions. Attackers found the gap between fixed in the newest version and fixed everywhere, and walked through it.
They didn't stop at the front door. Rapid7, citing Volexity's investigation, says the attacker also used a privilege escalation flaw that Ivanti plans to patch later. That is a second step for getting deeper control once inside.
Then it got bigger
On October 30, Canada's Cyber Centre updated its alert: CISA had added CVE-2026-111357 and CVE-2026-118527 to the exploited list. Both are Ivanti flaws. The updated alert now lists Connect Secure versions prior to 25.1.1.3, 25.1.3.1 and 22.8R2.6 as affected, so earlier fixed version numbers you may have noted in mid-October are no longer the finish line.
Older lines are spared: the vendor says versions 22.7.x and below are unaffected by the original flaw.
What is confirmed?
- Attackers exploited the flaw before Ivanti disclosed it.
- CISA lists it as exploited, from the day of disclosure.
- Two more Ivanti flaws were added to the exploited list on October 30.
- Ivanti says versions 22.7.x and below are unaffected by the original flaw.
Why it matters
VPN gateways sit on the edge of the network by design. That makes them the most valuable doors to pick. This product has seen zero-day attacks in both 2024 and 2025 too. Our reading: three years in a row means attackers have studied this product closely and will keep coming back.
What remains unknown?
- How many customers were breached. Ivanti says a limited number.
- Who is behind it, and what they took.
- When the privilege escalation flaw will be patched.
What readers should do
- Update to the latest fixed release for your code line, using Ivanti's advisory, now. Don't rely on version numbers from early October.
- Hunt, don't just patch. Rapid7 recommends looking for signs of compromise even after patching. A patched gateway can still hold an attacker who got in first.
- Follow Ivanti's recovery steps if you find anything suspicious. That usually means rebuilding the appliance and resetting credentials that passed through it.
- Treat the gateway as a crown jewel. Log it to a separate system, and watch for logins and admin changes you can't explain.