Ivanti's VPN Appliances Are Being Broken Into Without a Password

Key points

• CVE-2026-104935, a flaw in Ivanti Connect Secure that lets attackers bypass the login screen entirely, was added to the US government's actively-exploited list on 13 October 2026.
• Federal agencies face a legally binding deadline to patch, set by CISA after it added the flaw to the Known Exploited Vulnerabilities catalogue.
• The flaw carries a severity score of 8.6 out of 10 and affects Ivanti Connect Secure versions up to 22.8R2.4 and certain 25.1 releases; the 22.7 series is not affected.
• Ivanti quietly fixed part of the problem in July 2026 but was still backporting the fix to older supported versions when attackers began exploiting it in the wild.
• Fixed versions are available now: 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on which hardware or software branch an organisation runs.

Ivanti Connect Secure is software that sits at the edge of a company's network and acts as a gated entry point, letting employees connect remotely through an encrypted tunnel, what most people call a VPN, or virtual private network. Tens of thousands of organisations use it. When that gateway is compromised, everything behind it is exposed.

The flaw tracked as CVE-2026-104935 is an authentication bypass by spoofing. Authentication is the process of proving who you are, typically with a username and password. Spoofing here means tricking the system into treating a forged request as if it came from someone already logged in legitimately. The attacker never needs real credentials. According to the watchTowr intelligence team, whose FAQ is the source of record for the technical detail, the bypass travels a path that sits entirely outside the normal login flow, so any extra protections bolted onto that flow, multi-factor codes included, do nothing to stop it.

Once past the gate, the attacker can run arbitrary commands on the appliance itself. Arbitrary commands means whatever the attacker types, the machine obeys, as if they were a system administrator sitting in front of it.

How did this go unnoticed?

It wasn't entirely unnoticed. Ivanti says it found part of the vulnerability through its own internal security programme and patched that portion in version 25.1.3.0, released in July 2026. Older supported versions still needed the fix, and while that backporting work was underway, exploitation had already started. Shipping a partial patch without locking down all supported branches simultaneously is the failure mode security teams will be writing about in their post-mortems.

Volexity is credited with finding the active exploitation and has published details of how it works in the wild.

We covered Ivanti's authentication bypass problems in its Sentry and EPMM products back on 17 September. This one hits a broader installed base.

Should ordinary people be worried?

Directly, probably not, but indirectly, yes. Connect Secure is an enterprise product. The organisations running it protect hospitals, government agencies, financial institutions and schools. When attackers take control of a network gateway, everything on the other side of it, staff records, patient files, payment systems, becomes reachable.

If you work somewhere that uses a VPN to log into work systems, ask your IT team whether they run Ivanti Connect Secure and whether it has been patched. That is the single most useful question an ordinary employee can ask right now.

The CISA Known Exploited Vulnerabilities catalogue listing tells you everything about how seriously the US government is reading this. For federal agencies the deadline is a legal obligation under a binding directive, not a suggestion. Private organisations face no such obligation. That gap is, as usual, exactly the problem.