Ivanti Connect Secure EUVD-2026-98816

Exploitation requires network reachability to the Ivanti Connect Secure web/VPN interface, which on these edge appliances is typically internet-exposed by design, and a software version before 25.1.3.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are required - exploitation works against standard deployments. The primary limiting factor is version: installations running 22.7R2.14 or prior are explicitly not affected, and appliances upgraded to 25.1.3.0 or later are remediated.

This is a genuine top-priority vulnerability, with multiple independent signals aligning rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction - the easiest possible exploitation profile - and CWE-290 (Authentication Bypass by Spoofing) is consistent with the described unauthenticated access. Critically, CISA KEV confirms active exploitation in the wild and public exploit code is available, so this is not a theoretical high-CVSS issue but a confirmed, weaponized attack. One notable inconsistency: the description states the attacker can 'execute arbitrary commands,' which implies full system compromise, yet the supplied CVSS vector scores only C:H/I:L/A:L (low integrity and availability impact). Arbitrary command execution would normally justify I:H/A:H, so the published 8.6 score likely understates true impact - verify the impact metrics with Ivanti's advisory. Even taken conservatively, the combination of KEV listing, public POC, and unauthenticated network reach makes immediate patching mandatory for any internet-facing Ivanti Connect Secure appliance.

A remote, unauthenticated attacker sends a crafted request to an internet-facing Ivanti Connect Secure gateway that spoofs authentication, bypassing access controls to run arbitrary commands on the appliance. Public exploit code exists and CISA confirms this is being actively exploited in the wild, so mass scanning and opportunistic compromise of unpatched gateways should be assumed. Because the appliance is a VPN edge device, a successful exploit yields a foothold at the network perimeter.