CISA issued Emergency Directive 26-03 on Saturday, giving civilian federal agencies until August 4 to patch or disconnect every Ivanti Connect Secure appliance on their networks. The directive covers CVE-2026-4471, an unauthenticated command injection in the appliance's SAML handler that carries a CVSS score of 9.8. Mandiant attributes active exploitation to a cluster it tracks as UNC5789, which it assesses with moderate confidence is a Chinese state-linked contractor. Ivanti shipped a fix on Friday evening for supported branches, but roughly 14,000 internet-exposed appliances still answered on the vulnerable version when Shadowserver scanned on Sunday morning.
The bug and how it is being used
The flaw sits in code that parses SAML assertions before authentication completes. A crafted RelayState parameter reaches a shell invocation without sanitizing, which gives an attacker command execution as the web process. From there, privilege escalation to root uses a separate weakness in a setuid helper that Ivanti had documented as low severity in 2024 and never removed. Chained together, the result is full appliance compromise from an unauthenticated HTTPS request, with no user interaction and nothing in the default access log that would look unusual to an analyst skimming for failures.
Mandiant's report describes a consistent post-exploitation pattern. The operators deploy a small ELF implant named by the researchers as PANWORM, which hides inside the appliance's own upgrade partition so it survives a firmware update. They then harvest cached VPN credentials, enumerate internal DNS, and pivot to domain controllers using stolen certificates rather than passwords. Three of the victim organizations Mandiant worked with had already patched a previous Ivanti bug in February, which is how the team noticed the persistence trick: the implant was still there after a clean reinstall.
Why an emergency directive rather than a normal advisory
CISA reserves emergency directives for situations where it believes agencies cannot be trusted to move on a normal timeline. Executive Assistant Director Matt Hartman said in a press call that telemetry from federal networks showed exploitation attempts against at least seven agencies during the week of July 20, and successful intrusions at two. He would not name them. The nine-day window is shorter than the two weeks CISA allowed for the January 2024 Ivanti directive, and the agency explicitly told agencies not to wait for a maintenance window if they cannot patch immediately.
The directive also requires something new. Agencies must submit a forensic collection from every affected appliance, not just a confirmation that the patch landed, because the appliance's own integrity checker missed the implant in Mandiant's cases. CISA published a memory acquisition script and asked for output by August 6. Several agency CISOs told us privately that they lack the staff to run collection across dozens of appliances in that window, and expect to request extensions, which the directive permits only with written justification from an agency head.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
Ivanti's position and its patch history
Ivanti's statement acknowledges the severity and points to a hardening program the company started after its 2024 troubles, including a rewrite of the SAML stack that it says will land in the 24.x branch this autumn. The vulnerable code in this case predates that work. Chief Security Officer Daniel Spicer said the setuid helper used for escalation is now removed entirely rather than restricted, and that the upgrade partition will be verified against a signed manifest starting in the next release. None of that helps the appliances already carrying an implant.
The pattern is what worries defenders more than any single CVE. Connect Secure has now produced critical unauthenticated bugs in 2021, 2024, twice in 2025, and again this month. Each time the fix is narrow and the underlying architecture, a single monolithic appliance terminating untrusted traffic and holding domain credentials, stays intact. Several large enterprises have already replaced Ivanti with identity-aware proxies from Cloudflare, Zscaler, or Tailscale, and this directive will accelerate that. Ivanti's own quarterly filings show secure access revenue down 11 percent year over year.
What defenders should do this week
Patching is necessary and not sufficient. Any appliance that was internet-exposed on a vulnerable version between July 1 and Friday should be treated as compromised until proven otherwise, which in practice means rebuilding from clean media rather than upgrading in place. Every credential the appliance could see needs rotation: local admin accounts, the LDAP bind account, machine certificates, and any API keys stored in connection profiles. Teams should also assume session tokens issued during the window are attacker-controlled and force reauthentication across the estate.
Detection is harder than usual because the implant lives below the layer most tooling watches. The practical signals are network-side: unexpected outbound TLS from the appliance to hosting providers in Hong Kong and Singapore, DNS queries for internal names originating from the appliance itself, and Kerberos activity from the appliance's machine account at hours nobody works. Mandiant published Sigma rules and a list of 61 indicators. Organizations without the staff to hunt should at minimum pull 60 days of appliance netflow and hand it to an incident response retainer.
The policy fight this is about to start
Senator Mark Warner's office has already circulated a draft letter asking whether federal agencies should be permitted to buy network edge appliances from vendors with repeat critical vulnerabilities in the same product line. That idea has support from CISA staff and strong opposition from an industry group that argues any vendor with enough deployed base will eventually produce a bad CVE. The counterargument, which several federal CISOs made to us, is that repeat findings in the same subsystem indicate process failure rather than bad luck.
There is also a procurement angle that will outlast the news cycle. The FedRAMP program has no mechanism to downgrade an authorization for security engineering quality as opposed to a specific control failure. Two members of the FedRAMP board told us they are drafting language that would let the program require independent architecture review for products that terminate untrusted traffic. If that lands, it would reshape how the government buys VPN and gateway hardware more than any single patch cycle does.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Zero Trust
