A root-level compromise of a fully patched enterprise VPN appliance is the kind of event that keeps security teams awake at night, and that is precisely what researchers at Volexity uncovered in early October. The firm identified active, in-the-wild exploitation of a high-severity authentication bypass vulnerability in Ivanti Connect Secure, the widely deployed SSL VPN platform formerly known as Pulse Connect Secure. The flaw allows a remote attacker, with no credentials whatsoever, to execute arbitrary commands, harvest authentication data, and pull sensitive information out of corporate networks.
What makes this incident notable is not just the severity of the vulnerability itself, but the sophistication behind its use. Volexity determined that the threat actor did not rely on a single flaw but assembled a chain of three separate zero-day vulnerabilities to achieve full control of the targeted appliance. Two of these, the authentication bypass and an accompanying remote code execution bug, are now jointly tracked as CVE-2026-104935, carrying a CVSS v3.1 base score of 8.6. Organizations running Connect Secure appliances for remote workforce access, regardless of which client software employees use to download the app and connect, should treat this disclosure as an immediate operational priority rather than routine patch-cycle news. download the app
Enterprise SSL VPNs like Connect Secure sit at the edge of corporate networks by design, authenticating remote users before granting access to internal resources. That positioning makes them a prized target: compromise the gateway, and an attacker inherits a trusted foothold inside the perimeter. In this case, the authentication bypass component allowed the intruder to skip the login process entirely, while the paired remote code execution flaw turned that access into the ability to run commands with root privileges. A third vulnerability, enabling privilege escalation, remains unpatched as Ivanti continues developing a fix for a future release. Chaining vulnerabilities in this manner is a hallmark of advanced, well-resourced threat actors rather than opportunistic criminals, since it requires detailed knowledge of the appliance's internal architecture.
Ivanti has confirmed that exploitation has so far affected a limited number of ICS customers, and the vulnerability has been added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, a designation that typically triggers mandatory remediation timelines for U.S. federal agencies and signals elevated risk for private-sector organizations as well. Patches are available for the affected product lines:
Patching alone, however, is not considered sufficient given the nature of this attack. Ivanti and Volexity both recommend that administrators run the Integrity Checker Tool regularly to detect signs of tampering, since the attacker demonstrated the ability to compromise an appliance that was already fully updated at the time of intrusion. Volexity has published a limited set of indicators of compromise in its technical write-up to help defenders hunt for related activity within their own environments.
Edge network appliances, including VPN gateways, firewalls, and secure access gateways, have become a preferred entry point for sophisticated intrusions precisely because they are internet-facing and often exempt from the endpoint monitoring applied to ordinary workstations. The Connect Secure product line in particular has a documented history of targeting by advanced persistent threat groups, reflecting its deep entrenchment in government, financial, and critical infrastructure networks. This latest disclosure reinforces a broader lesson for anyone responsible for remote access infrastructure: perimeter devices require the same scrutiny, logging, and rapid patch discipline as the internal systems they protect, because a single unauthenticated flaw at the edge can unravel defenses built up everywhere else.