A fully patched appliance should not fall. Yet on a build of Ivanti Connect Secure that administrators had every reason to trust, an unknown intrusion group walked in, took root, and helped itself to credentials, directory data and internal network traffic. The appliance was running 22.8R2.4 - current at the time of the breach, now listed as vulnerable. The gap between what Ivanti fixed in July and what it disclosed in October is the story, and it raises an uncomfortable question for every organization running an internet-facing gateway: what does "patched" actually guarantee?
A Chain Fixed in Parts
Ivanti disclosed CVE-2026-104935 on Oct. 13, 2026, describing a high-severity, unauthenticated authentication-bypass flaw in Connect Secure scored 8.6 on the CVSS scale. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog the same day, citing credential theft and data exfiltration tied to active exploitation. Ivanti said exploitation was limited at the time of disclosure, though it has not published a customer count.
The flaw is only part of the picture. Security firm Volexity, which investigated the intrusion into the 22.8R2.4 appliance, described three vulnerabilities working in sequence: an authentication bypass, a file-write flaw, and a privilege-escalation issue in how a system broker handles cached configuration data. Ivanti's October disclosure covers the first two. The third, as of the most recent reporting available, remains unfixed. Chained together, the three gave attackers unauthenticated code execution with root-level privileges on an SSL VPN gateway - a device that sits directly between remote users and internal networks.
July's Fix, October's Breach
Ivanti says its internal product-security program found part of the issue and patched it in 25.1.3.0, released in July 2026, then began backporting that fix to other supported branches. Volexity dates exploitation of the 22.8R2.4 appliance to at least Oct. 3; other reporting places initial in-the-wild exploitation as early as Oct. 1. Ivanti's fixed builds for the 25.1.1 and 22.8 lines did not arrive until Oct. 5 and Oct. 12 respectively - meaning customers on those branches carried the exposure for roughly three months after the July release, with no public record of interim mitigation guidance during that stretch.
Asked about the sequencing, an Ivanti spokesperson told CyberScoop that the flaw was found internally, was not being actively exploited at the time, and "did not meet the threshold for an out-of-band release," so a fix was scheduled for the normal release cycle instead. The company also argued that because exploitation requires chaining multiple vulnerabilities, fixing the authentication-bypass component eliminated "the primary exploitation path." Both statements are defensible in isolation. Together they describe a bet that a partial fix plus ordinary release timing would hold until the next cycle caught up. The October intrusion shows that bet did not pay off everywhere.
What a Rooted Gateway Actually Costs
The technical severity score understates the damage. Once inside, the tracked actor - identified as UTA0576 - reportedly collected credentials, pulled Active Directory metadata, copied appliance configuration files, and captured LDAP traffic. A compromised VPN gateway does not just grant access to one box; it hands over a working map of the internal network and a set of passwords that remain valid even after the software itself gets patched. That is why Ivanti's guidance extends past the upgrade instruction: run the Integrity Checker Tool, restrict administrative access, review logs, and - critically - rotate any credentials that may have passed through a vulnerable appliance before the fix was applied. An upgrade alone does not undo a theft that already happened.
Version Fatigue and a Looming Deadline
Administrators now face a layered decision. The affected builds are 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier; the fixes are 22.8R2.5, 25.1.1.2, and 25.1.3.0 or later. None of this exists in a vacuum: Ivanti has set Jan. 31, 2027 as the end-of-life date for the entire 22.x line, and describes 22.8 as a temporary bridge toward 25.1. Organizations that patch to 22.8R2.5 today buy roughly three months before that branch stops receiving support altogether, meaning a second migration is already on the calendar.
The 22.7 line is worth a specific caution. Ivanti says builds 22.7.14 and earlier are not affected by this particular CVE, but that clearance applies to one vulnerability, not to the product's long-term support status, and the same end-of-life date applies there too. A clean scan against October's bug is not a reason to delay the broader migration.
The incident also fits a wider pattern this year: edge and gateway devices - appliances that face the public internet by design, run vendor-specific firmware rarely audited by outsiders, and cannot host standard endpoint monitoring - have become the preferred entry point for intrusion groups willing to study one product family in depth. When exploitation reaches root on hardware like this, conventional detection tools see nothing. The only reliable warning signs come from the vendor's own integrity-checking tools, network-level monitoring, and scrutiny of what the appliance talks to internally - especially domain controllers. Until Ivanti ships a fix for the remaining privilege-escalation flaw, that vigilance is not optional.
