A vulnerability that Ivanti found inside its own labs in July still ended up granting an outside attacker root access to a customer's Connect Secure appliance in October. On Oct. 13, 2026, the company disclosed CVE-2026-104935, an authentication-bypass flaw scored 8.6 on the CVSS scale, and the Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day. The real story sits in the three months between those two points, and in the fact that the appliance attackers broke into was running a build Ivanti considered fully patched.
A Fix That Only Covered Part of the Problem
Ivanti says its internal product-security program discovered the flaw before anyone exploited it and folded a fix into 25.1.3.0, released in July 2026. The company then began backporting that fix to other supported branches on its normal release schedule rather than issuing an emergency patch, reasoning that an internally found, not-yet-exploited bug did not clear the bar for an out-of-band release. Volexity's incident-response team later determined that exploitation of a related chain began by at least Oct. 3, and possibly as early as Oct. 1, against an appliance running 22.8R2.4 - a build that was current and fully patched against everything publicly known at the time.
Volexity's researchers tracked the intrusion to a previously unidentified actor it calls UTA0576, who combined three separate flaws: an authentication bypass, a file-write bug, and a privilege-escalation path through the appliance's configuration broker. Chained together, those three steps produced unauthenticated code execution with root privileges. Ivanti's October disclosure addressed the first two components. The third, the privilege-escalation flaw, had no public fix as of the most recent reporting, though Ivanti has indicated one is planned for a future release.
The Version Map Admins Actually Need
The affected and fixed builds span three code lines, and they do not align neatly, which makes a careless upgrade dangerous in its own right.
- 22.8 line: 22.8R2.4 and earlier are vulnerable; 22.8R2.5, released Oct. 12, fixes the disclosed flaw but remains, in Ivanti's own description, a temporary bridge toward 25.1.
- 25.1.1 line: 25.1.1.1 and earlier are vulnerable; 25.1.1.2, released Oct. 5, is fixed.
- 25.1.2 line: 25.1.2.2 and earlier are vulnerable; customers should move to 25.1.3.0 or later.
- 22.7 line: not affected by this particular CVE, but it shares the same Jan. 31, 2027 end-of-life date as the rest of the 22.x family, so a clean bill of health on one bug is no reason to stay on it.
Two of those fixed builds, 25.1.1.2 and 22.8R2.5, were released on Oct. 5 and Oct. 12, before Ivanti's public disclosure on Oct. 13. Customers who track release notes closely could have upgraded a week early, but nothing in Ivanti's communications at the time flagged urgency. That silence matters because the exploitation window had already opened.
What Root Access on a VPN Gateway Actually Costs
An SSL VPN appliance sits on the path between remote users and an organization's internal directory, so compromising one is rarely about the box itself. According to Volexity's findings, the attackers behind UTA0576 used their foothold to harvest credentials, pull Active Directory metadata, steal appliance configuration files, and capture LDAP traffic. Any organization that patches the appliance without also rotating credentials and auditing directory activity is treating the symptom while leaving the stolen material valid.
This is not an isolated pattern. Perimeter gateways - VPN concentrators, firewalls, and similar edge devices - have become a preferred target precisely because they face the internet by design, run specialized firmware that outside researchers rarely examine, and usually cannot host the endpoint detection software that would flag unusual behavior elsewhere on a network. When a chain reaches root on one of these devices, the signals a defender needs often come only from the vendor's own integrity-checking tools and from the logs of systems the appliance talks to, such as domain controllers.
A Deadline That Complicates Every Decision
Ivanti has paired this disclosure with a broader push toward its 25.x line, pointing to a Jan. 31, 2027 end-of-life date for the entire 22.x family. That leaves administrators on 22.8R2.4 with an awkward choice: install 22.8R2.5 for an immediate fix, then still face a full migration to 25.x within about three months, or jump straight to a 25.1 branch and avoid a second disruption. Ivanti's advisory also lists a newer 25.1.4.0 release with updated notes, though the public record does not make clear how closely that build is tied to the October security fixes, so treating it as a security target without checking the advisory directly would be a mistake.
The unresolved privilege-escalation flaw narrows the practical risk on patched systems - an attacker without another way in can no longer reach it through the now-closed authentication bypass - but it does not eliminate it. Anyone who gains a foothold by other means, including stolen administrator credentials, could still attempt that path. Ivanti's own guidance reflects this: run the Integrity Checker Tool regularly, restrict who can reach the administrative interface, and treat any system exposed before the patch as a possible compromise rather than a closed case.