Two of the most widely deployed remote-access platforms in corporate networks are under active attack at the same time. On October 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) warned that a new Ivanti Connect Secure zero-day, tracked as CVE-2026-104935, is being exploited in the wild to run commands as root without a login. Nine days earlier, on October 4, Citrix had already pushed emergency patches for CVE-2026-88779, a NetScaler flaw that attackers were using in targeted denial-of-service campaigns. Together, the two incidents mark the latest round in a now-familiar cycle: enterprise edge appliances, the boxes that sit between the open internet and the corporate network, keep becoming the easiest way in.
For security teams, the timing could not be worse. Both vendors have been repeat targets since 2023, and both flaws arrived with limited technical detail, incomplete patch guidance in some branches, and active exploitation already underway before most customers had a chance to react. This is a breakdown of what is actually known about each Ivanti Connect Secure zero-day and Citrix NetScaler flaw, what happened the last three times this exact scenario played out, and what it means for the companies that still run these appliances at the edge of their networks.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Is CVE-2026-104935? Inside the Ivanti Connect Secure Zero-Day
CVE-2026-104935 is an authentication-bypass vulnerability in Ivanti Connect Secure, the company’s enterprise VPN gateway, classified under CWE-290 (authentication bypass by spoofing). The flaw lets a remote, unauthenticated attacker execute arbitrary commands, and according to CISA, attackers who exploit it can run those commands with root-level privileges without ever logging in. That is the worst-case outcome for a perimeter device: full control of the appliance, no credentials required, and no helpful error message left behind for defenders to find.
Reported affected versions include Ivanti Connect Secure 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti has not published a CVSS numerical score for the flaw in the material currently available, but it has been described as high severity given the unauthenticated root-access outcome. CISA says threat actors are using the access not just to sit inside the network, but specifically for credential theft and data exfiltration, meaning this is not a theoretical foothold. It is an active data-stealing campaign running right now against unpatched appliances.
Ivanti disclosed the issue publicly on October 13, 2026, the same day CISA issued its alert, and urged every customer running an affected version to patch immediately. The company said it was already working directly with organizations it knew had been targeted, while making remediation guidance available to the rest of its customer base at the same time.
How Attackers Chained Three Flaws to Reach Root
The most alarming detail to emerge so far did not come from Ivanti. It came from Volexity, the incident-response firm that first flagged exploitation. According to Volexity’s reporting, an attacker chained three separate Ivanti Connect Secure zero-days together to obtain root access on targeted appliances, rather than relying on a single flaw in isolation. Chaining multiple bugs is a hallmark of a well-resourced, patient attacker, since it requires deep familiarity with the target codebase and the discipline to hold several unpatched bugs in reserve rather than burning them one at a time.
The Volexity Investigation Timeline
Sean Koessel, vice president of professional services at Volexity, discussed the exploitation timeline and said it “wouldn’t surprise us if there was activity toward the end of September,” according to CyberScoop’s reporting on the investigation. Volexity separately confirmed its earliest observed instance of exploitation on October 1, 2026, roughly two weeks before Ivanti’s public disclosure and CISA’s alert. That gap, between first observed exploitation and public patch guidance, is the window attackers count on, and in this case it stretched close to two weeks.
For defenders, the recommended response goes beyond installing the patch. CISA and Ivanti are both telling customers to assume compromise if their appliance was internet-facing and unpatched during that window: rotate credentials that may have transited the device, preserve forensic images before rebooting, and hunt specifically for unauthorized commands and persistence mechanisms rather than simply confirming the patch applied cleanly.
Citrix NetScaler’s CVE-2026-88779: A Second Front Opens
While Ivanti’s crisis was unfolding, Citrix was still working through the fallout from its own October disclosure. CVE-2026-88779 affects Citrix NetScaler ADC and NetScaler Gateway, the products formerly sold as Citrix ADC and Citrix Gateway. Citrix classified it as CWE-119, a memory-buffer restriction flaw, and assigned it a CVSS 4.0 base score of 8.7. The documented impact is denial of service rather than confirmed remote code execution, though researchers were still investigating at the time of disclosure whether the bug could be escalated further.
SAML Configuration Is the Trigger
The flaw only applies to appliances configured as a SAML service provider or SAML identity provider, a narrower blast radius than a flaw that hits every deployment regardless of configuration. But the published CVSS vector shows the bug is reachable over the network with no privileges and no user interaction required, which is exactly the profile ransomware crews look for when scanning the internet for easy targets. Citrix said the flaw had already been used in targeted attacks against unpatched deployments by the time it shipped fixed releases on October 4, 2026: versions 14.1-73.41, 13.1-64.28, and the corresponding 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP branches.
Citrix also disclosed a separate NetScaler issue around the same period, tracked as CVE-2026-107406, which the company described this way: “CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions,” according to reporting that tracked both the Ivanti and Citrix campaigns. The two Citrix issues landing close together underscore how much exploitation pressure NetScaler appliances are absorbing this quarter alone.
CISA’s Response and the KEV Catalog Deadline
CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities (KEV) catalog, the formal mechanism the agency uses to confirm real-world exploitation and set a binding patch deadline for federal civilian agencies. Federal Civilian Executive Branch agencies were reportedly given until October 7, 2026, just three days after Citrix’s patch release, to mitigate the NetScaler flaw. That is an unusually tight turnaround even by KEV standards, reflecting how quickly the agency judged the exploitation to be spreading.
On the Ivanti side, CISA’s language was equally direct. In its October 13 alert, the agency stated: “CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration,” according to CISA’s published alert. The agency has not yet listed a comparable KEV deadline specifically tied to CVE-2026-104935 in the material available at publication time, but given the pattern with CVE-2026-88779, a formal KEV listing and short remediation window for federal agencies would not be a surprise.
Why Edge Appliances Keep Becoming the Weakest Link
Neither Ivanti nor Citrix is new to this problem, and that history matters for understanding why October 2026 looks so familiar. Ivanti Connect Secure, formerly sold as Pulse Secure, was at the center of one of the most damaging edge-device campaigns of the decade. Mandiant observed exploitation of CVE-2023-46805 and CVE-2024-21887 beginning as early as December 3, 2023, weeks before Ivanti disclosed either flaw on January 10, 2024. Mandiant attributed that early, pre-disclosure exploitation to UNC5221, a suspected China-nexus espionage actor, and it was the only group observed using both bugs before patches existed.
The fallout escalated fast. On January 19, 2024, CISA issued Emergency Directive 24-01, ordering every federal agency running affected Ivanti Connect Secure or Policy Secure appliances to mitigate immediately. By February 29, 2024, CISA confirmed a third flaw, CVE-2024-21893, was being chained with the original two to bypass authentication and execute commands with elevated privileges, almost exactly the pattern Volexity is now describing with the three-flaw chain behind CVE-2026-104935. Mandiant later identified at least seven distinct China-linked clusters, including UNC5266, UNC5291, UNC5325, UNC5330, UNC5337, and UNC3886, exploiting the same family of Ivanti bugs once the vulnerabilities became public knowledge. Patches for all supported versions did not become available until April 3, 2024, nearly four months after exploitation began.
Ivanti was back in the headlines less than a year later. On January 9, 2025, Mandiant disclosed another Ivanti Connect Secure zero-day campaign, again attributed to UNC5221, with a suspected nation-state nexus. Citrix has its own version of this story: CVE-2023-4966, nicknamed CitrixBleed, was identified in October 2023 and went on to be heavily weaponized by ransomware groups, with Xfinity, Boeing, and Toyota among the named organizations later confirmed to have been affected. A follow-up, informally dubbed CitrixBleed 2 and tied to CVE-2025-6543, surfaced in 2025, with CVE-2025-6543 confirmed as actively exploited before a complete victim count was ever established publicly.
The Pattern Behind the Pattern: Nation-State Actors and Ransomware Crews
What makes edge appliances such a durable target is that they attract two very different kinds of attackers for the same underlying reason: they sit in front of the authentication layer, which means a working exploit skips the hardest part of any intrusion. Nation-state groups like UNC5221 use that access for long-term espionage, favoring stealth and persistence over speed. Ransomware crews, by contrast, treat a fresh NetScaler or Connect Secure bug as a race against every other criminal group watching the same disclosure, which is why CitrixBleed became an initial-access vector for multiple competing ransomware operations within weeks of becoming public.
Neither Ivanti nor Citrix has named a specific threat actor or ransomware group tied to the October 2026 flaws in the material published so far. That silence does not mean attribution will not come. In both the 2024 Ivanti campaign and the original CitrixBleed wave, attribution to specific clusters emerged weeks to months after the initial disclosure, once incident responders had time to compare intrusion tooling across victims. The absence of a named actor today is a timing gap, not evidence that this is a lower-stakes event.
Market Impact: What This Means for Enterprise Security Budgets
The immediate cost of an Ivanti Connect Secure zero-day or a Citrix NetScaler zero-day is rarely the patch itself. It is the incident-response work that follows: forensic review of every internet-facing appliance, credential rotation across any system the device could reach, and in many cases a full compromise assessment even when no direct evidence of follow-on activity turns up. Organizations that were still running on-premises Citrix or Ivanti infrastructure after the 2023 and 2024 campaigns already absorbed one or two rounds of that cost. A third or fourth round in as many years changes the calculation CISOs bring to renewal conversations.
That dynamic is already visible in how security vendors talk about the category. Secure Access Service Edge (SASE) and zero-trust network access (ZTNA) vendors have spent the last two years pitching themselves explicitly as an alternative to perimeter VPN appliances, and every fresh Ivanti or Citrix disclosure gives that pitch more weight with buyers who are tired of emergency patch cycles. The practical effect is not an overnight rip-and-replace, since large enterprises cannot swap core remote-access infrastructure on short notice, but it does accelerate budget conversations that were already underway before this week’s disclosures.
Competitive Comparison: How Edge-Appliance Vendors Have Handled Disclosure
Both vendors moved quickly once exploitation was confirmed, but the shape of their responses differed in ways that matter to the customers deciding how much trust to extend going forward.
| Vendor | Flaw Type This Cycle | Time From Patch to KEV/Federal Deadline | Public Attribution Named | History of Repeat Zero-Days |
|---|---|---|---|---|
| Ivanti (Connect Secure) | Auth bypass, root RCE | Disclosed same day as CISA alert (Oct. 13, 2026) | No actor named yet | Yes — 2024 and 2025 campaigns, both tied to UNC5221 |
| Citrix (NetScaler ADC/Gateway) | Memory-buffer restriction, DoS | 3 days (patched Oct. 4, KEV deadline Oct. 7, 2026) | No actor named yet | Yes — CitrixBleed (2023) and CitrixBleed 2 (2025) |
| Fortinet (FortiMail) | CVSS 9.8, CISA KEV listed | Separate 2026 incident, added to KEV | Not disclosed in public reporting | Yes — recurring FortiOS/FortiMail KEV entries |
| Cisco / SonicWall | CVSS 10.0, CISA KEV listed | Separate 2026 incident, added to KEV | Not disclosed in public reporting | Yes — recurring appliance-level KEV entries |
The pattern across all four rows is the same: every major edge-appliance vendor on this list has landed on the CISA KEV catalog more than once in the past three years. That is not a coincidence of bad luck. It reflects how attractive internet-facing appliances with privileged network access remain to both espionage actors and ransomware affiliates, regardless of which vendor’s logo is on the box.
CVE Snapshot: Side-by-Side Comparison
| CVE | Product | CVSS | Vulnerability Type | Disclosed | Confirmed Impact |
|---|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect Secure | Not yet published; described as high severity | Auth bypass by spoofing (CWE-290) | Oct. 13, 2026 | Unauthenticated root command execution, credential theft, exfiltration |
| CVE-2026-88779 | Citrix NetScaler ADC/Gateway | 8.7 (CVSS 4.0) | Memory-buffer restriction (CWE-119) | Oct. 4, 2026 | Denial of service in SAML SP/IdP configurations |
| CVE-2026-107406 | Citrix NetScaler | Not specified in available reporting | Memory overflow | October 2026 | Potential RCE or DoS depending on configuration |
| CVE-2024-21887 / CVE-2023-46805 | Ivanti Connect Secure (historical) | Not restated here; 2024 campaign | Command injection / auth bypass | Jan. 10, 2024 | Chained to achieve elevated command execution |
| CVE-2023-4966 (CitrixBleed) | Citrix NetScaler (historical) | Not restated here; 2023 campaign | Session-token leak | Oct. 2023 | Session hijacking, ransomware initial access |
Laid out this way, the 2026 flaws are not outliers. They are the latest entries in a table that has been filling up with Ivanti and Citrix rows since late 2023, and every entry on it eventually became either an espionage foothold, a ransomware access point, or both.
What Security Teams Should Do Right Now
Ivanti’s own guidance is specific: “Customers should review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly,” according to the company’s public remediation guidance. That last step matters more than it sounds. The Integrity Checker Tool is designed to flag filesystem modifications an attacker might have made before the appliance was patched, which is exactly the kind of evidence a simple version upgrade will not surface on its own.
For teams running either product, the minimum response checklist looks like this:
1. Patch immediately:
- Ivanti Connect Secure: upgrade past 22.8R2.4 / 25.1.2.2 / 25.1.1.1
- Citrix NetScaler ADC/Gateway: upgrade to 14.1-73.41 or 13.1-64.28
(or the matching FIPS/NDcPP branch: 14.1-73.41 FIPS / 13.1-37.282)
2. Run Ivanti's Integrity Checker Tool against pre-patch firmware state
3. Rotate credentials that may have transited the appliance:
- VPN user credentials
- Any service accounts or API keys the appliance could reach
4. Hunt for indicators before assuming a clean bill of health:
- Unexpected scheduled tasks or cron entries
- Unfamiliar local accounts or SSH keys
- Outbound connections to unfamiliar infrastructure
5. Disable SAML SP/IdP role on NetScaler where not strictly required
until the patched build is confirmed in productionNone of this is optional work layered on top of patching. Given that Volexity traced exploitation of the Ivanti flaw back to October 1, 2026, roughly two weeks before public disclosure, any organization running an affected, internet-facing Connect Secure appliance during that window should treat compromise as the default assumption until forensic review says otherwise.
The Bigger Picture: Is It Time to Retire Perimeter VPNs?
Every time an Ivanti Connect Secure zero-day or a Citrix NetScaler zero-day makes headlines, the same question resurfaces among security architects: why are organizations still routing remote access through a single internet-facing box with full network visibility once a user authenticates? The architectural critique is not new. Traditional VPN appliances grant broad network-level access once a session is established, which is precisely why a single root-level compromise on the appliance itself is catastrophic rather than merely inconvenient.
Zero-trust network access models are designed around a different assumption: access is brokered per-application rather than per-network, and the broker itself holds far less standing privilege than a classic VPN concentrator. That does not make ZTNA immune to zero-days, but it does shrink the blast radius when something does go wrong. The practical obstacle has always been migration cost and complexity for large enterprises with years of VPN-dependent workflows, which is why Ivanti and Citrix retain large installed bases even after multiple severe incidents. Each new disclosure chips away at that inertia a little more, without yet being enough to force wholesale replacement across the industry.
What Happens Next: 5 Predictions
- Attribution will surface within weeks. Based on the 2024 and 2025 precedent, expect incident-response firms to name a specific actor or cluster behind the Ivanti Connect Secure zero-day once more victim telemetry is compared, likely before the end of November 2026.
- A formal CISA KEV listing and short deadline for CVE-2026-104935 is likely. Given the three-day turnaround CISA imposed on the Citrix flaw, a comparable or tighter deadline for the Ivanti bug would match the agency’s recent posture toward actively exploited edge-device flaws.
- Ransomware affiliates will attempt to weaponize both flaws for initial access within the next one to two months, mirroring how CitrixBleed became a multi-group ransomware vector shortly after its 2023 disclosure.
- More Citrix NetScaler advisories are likely before year-end. CVE-2026-88779 and CVE-2026-107406 landing within the same month suggests Citrix’s ongoing internal review of NetScaler code is still surfacing additional issues.
- Zero-trust and SASE vendors will use both incidents in sales conversations through the rest of 2026, accelerating migration planning even if actual appliance replacement timelines remain measured in years rather than months for most large enterprises.
How This Compares to Other 2026 Edge-Device Incidents
The Ivanti and Citrix disclosures land in a year that has already seen other major network-edge vendors forced onto the CISA KEV catalog. Separate 2026 incidents pushed Fortinet’s FortiMail (rated CVSS 9.8) and a Cisco-linked SonicWall flaw (rated CVSS 10.0) onto the same list earlier this year. Taken together, the common thread across all of these incidents is not a single vendor’s engineering failure. It is the structural risk of putting any internet-facing appliance, regardless of brand, at the single chokepoint between untrusted traffic and an authenticated internal network. Every vendor in that position has now had at least one KEV-listed incident in 2026 alone.
That repetition is starting to shape procurement conversations beyond just “which vendor is safest.” Increasingly, security leaders are asking a different question: how much standing privilege does any single appliance need to hold, and can that privilege be reduced architecturally rather than just patched reactively after the next disclosure.
Frequently Asked Questions
What is CVE-2026-104935?
It is an authentication-bypass zero-day in Ivanti Connect Secure that lets a remote, unauthenticated attacker run commands as root. CISA disclosed active exploitation on October 13, 2026, and said attackers are using it for credential theft and data exfiltration.
Which Ivanti Connect Secure versions are affected?
Reported affected versions include 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Customers should check Ivanti’s advisory for the exact fixed build for their deployment.
What is CVE-2026-88779 on Citrix NetScaler?
It is a memory-buffer restriction flaw (CWE-119) with a CVSS 4.0 score of 8.7, affecting NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Citrix confirmed exploitation leading to denial of service and patched it on October 4, 2026.
Did attackers chain multiple Ivanti zero-days together?
Yes. Volexity reported that an attacker chained three separate Ivanti Connect Secure zero-days to obtain root access, rather than relying on a single flaw. Volexity’s earliest observed exploitation dates to October 1, 2026.
Is this related to the 2024 Ivanti zero-day crisis?
It is the same product family facing a new, separate vulnerability. The 2024 campaign involved different CVEs (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893) and was attributed to the China-nexus actor UNC5221. CVE-2026-104935 is a distinct flaw disclosed in October 2026.
Has a specific threat actor or ransomware group been named for the 2026 flaws?
Not yet in public reporting. CISA and Ivanti refer generically to “cyber threat actors,” and no ransomware group has been formally attributed to either the Ivanti or Citrix flaw as of this writing.
What should organizations do if they run an affected appliance?
Patch immediately to the fixed version, run Ivanti’s Integrity Checker Tool (for Connect Secure) to check for pre-patch compromise, rotate credentials that transited the device, and hunt for unauthorized persistence mechanisms rather than assuming the patch alone resolves prior exposure.
Does this mean enterprises should abandon VPN appliances for zero-trust access?
Not immediately, but the repeated pattern of severe Ivanti and Citrix zero-days since 2023 is accelerating budget conversations around zero-trust network access and SASE architectures that reduce the standing privilege any single internet-facing appliance holds.
Related Coverage
- FortiMail Zero-Day Hits CVSS 9.8, Lands on CISA KEV [2026]
- Cisco, SonicWall Zero-Days Rock CISA KEV: CVSS 10.0 [2026]
- EY Breach Reveals 85-Day Vendor Risk Gap [2026]
- ASOS Hack Alert Hits App Users, 14-Day Leak Threat [2026]
- Secure AI Agent Credentials: 13-Step MCP Setup [2026]
