Hackers are exploiting new Ivanti VPN and Cisco email security flaws: patch now
Two widely used business security products have flaws that attackers used before fixes were available. Here is who is affected and what to do.
Two products that many companies rely on to stay safe have become targets themselves. This week, Ivanti and Cisco both disclosed security flaws that attackers were already exploiting. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both to its catalogue of known exploited vulnerabilities.
If your organisation uses either product, treat this as urgent.
1. Ivanti Connect Secure (VPN)
Ivanti Connect Secure is a VPN that lets employees connect safely to company networks from home or on the road. On October 13, Ivanti disclosed CVE-2026-104935, an authentication bypass flaw rated 8.6 out of 10 for severity.
- What it allows: security firm Rapid7 says a remote attacker without a password can run commands on the device.
- Exploited already: Ivanti says a limited number of customers were attacked before the fix was available. Security company Volexity spotted the activity in early October.
- A second, unpatched flaw: Volexity reports the attackers also used a separate privilege escalation bug that Ivanti plans to fix later.
Fixed versions: 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, depending on your code line. Ivanti says versions 22.7.x and older are not affected by this flaw.
2. Cisco Secure Email Gateway
Cisco’s email gateway scans company email for malware and spam. On October 14, Cisco warned that CVE-2026-76519, which Cisco describes as an arbitrary file write vulnerability, is being exploited in the wild.
Affected software, according to Canada’s Cyber Centre:
- AsyncOS for Secure Email Gateway: release 15.5 before 15.5.5-014, and release 16.5 before 16.5.0-780
- Secure Email and Web Manager: release 15.5 before 15.5.5-006, and release 16.5 before 16.5.0-429
Security devices sit at the edge of the network. When they are vulnerable, they become the front door for attackers.
Why attackers love these devices
VPNs and email gateways are connected to the internet all the time and have deep access to company networks. They are also harder to monitor than normal computers. That makes them a favourite target for criminal gangs and state-backed hackers. Ivanti’s VPN products in particular have been hit by several serious attacks in recent years.
What to do now
- Patch immediately, outside your normal update schedule if needed.
- Check for signs of compromise even after patching. Rapid7 strongly recommends this, because attackers may already be inside. Volexity has published indicators that security teams can search for.
- Follow the vendors’ advisories for recovery steps if you suspect an attack.
- Limit exposure: management interfaces should never be reachable from the open internet.
Small businesses that use a managed IT provider should contact them today and ask whether these products are in use and whether they have been updated.
