Ivanti Connect Secure Critical Patch — Do Not Delay
Ivanti released an out-of-band patch for CVE-2026-1122, a stack-based buffer overflow in Connect Secure and Policy Secure gateways allowing unauthenticated remote code execution. CVSS score: 9.8.
Vulnerability Details
Ivanti disclosed CVE-2026-1122 on April 16, 2026, a stack-based buffer overflow vulnerability in the web component of Ivanti Connect Secure and Policy Secure gateways. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and allows an unauthenticated remote attacker to execute arbitrary code on the affected appliance. No authentication or user interaction is required — an attacker simply needs to send a specially crafted HTTP request to the management interface. Ivanti released an out-of-band patch the same day, indicating the severity warranted immediate action outside of their normal patch cycle.
CISA Emergency Directive
CISA issued Emergency Directive 26-03 on April 16, 2026, requiring all federal civilian executive branch agencies to apply the Ivanti patch within 48 hours. CISA also strongly recommended that all organizations — including private sector businesses — treat this with the same urgency. This is the third CISA emergency directive related to Ivanti products in the past 18 months, reflecting the ongoing security challenges with this product line. CISA's directive also requires agencies to perform a factory reset of affected appliances after patching, as prior Ivanti vulnerabilities were exploited to install persistent malware that survived standard updates.
Post-Patch Actions
Patching alone may not be sufficient if your appliance was already compromised. Ivanti and CISA recommend performing a factory reset of the appliance after applying the patch, then re-provisioning it from a known-good configuration backup. Review your VPN authentication logs for the past 30 days for signs of exploitation — look for authentication attempts from unusual geographic locations, successful authentications followed by unusual activity, or any configuration changes you did not make. If you find evidence of compromise, treat this as a security incident and engage your incident response process.
- Apply the Ivanti patch within 48 hours — CISA has issued an emergency directive
- If you cannot patch immediately, take the appliance offline until patching is complete
- After patching, perform a factory reset and re-provision the appliance per Ivanti's guidance
- Review VPN logs for signs of exploitation — look for unusual authentication patterns
- Consider replacing Ivanti with an alternative VPN solution if your organization has been repeatedly affected by Ivanti vulnerabilities
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.