Health system VPN appliances that clinicians use to reach electronic health records are being rooted through a chain of Ivanti Connect Secure flaws, including one that still has no patch. Ivanti confirmed on October 14 that attackers exploited three zero-days against fully updated ICS gateways, in some cases reaching root-level code execution on the appliance itself.
Volexity spotted the intrusion in the first week of October. The chain pairs an authentication bypass with a remote code execution bug, jointly tracked as CVE-2026-104935, which carries a CVSS score of 8.6. A third privilege escalation flaw remains unpatched and is slated for a future release. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog, putting federal remediation deadlines in motion.
The exposure matters for hospitals because SSL VPNs are the front door to clinical systems. A rooted gateway can let an intruder harvest credentials, pivot into the network, and reach the record stores behind it, with no malware needed on a clinician’s laptop.
Ivanti has shipped fixes in Connect Secure 25.1.1.2, 25.1.3.0 and 25.1.3.1, plus 22.8R2.5. Any appliance at 25.1.1.1, 25.1.2.2 or 22.8R2.4 and earlier is exposed. Administrators should patch immediately, run the built-in Integrity Checker Tool, and hunt for the limited indicators of compromise Volexity published. Because the privilege escalation flaw has no fix yet, healthcare security teams should assume a patched appliance can still be escalated and monitor authentication logs for anomalous sessions.
Regulators treat an internet-facing VPN as a system that touches protected health information, so a compromise here can trigger breach notification duties even before patient records are confirmed stolen.
