← All articles

Patch the Edge First: The Ivanti Warning Every Small Business Should Read

By Front Range Cybersecurity ·

Attackers don't have to know who you are. They only have to find your login page.

That is the lesson of the last few weeks. On October 30, 2026, CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities (KEV) catalog. Weeks earlier, it had warned about exploited zero-days in Citrix NetScaler. Different products, same pattern: the devices on your network's front edge are the ones under fire.

If your patch queue is longer than your week, this post tells you what goes first.

What happened this week

CVE-2026-111357 and CVE-2026-118527, both in Ivanti Connect Secure, joined the KEV catalog on October 30, "based on evidence of active exploitation," according to CISA. They follow CVE-2026-104935, added October 13. CISA's alert on the three says it is aware of threat actors exploiting them, which "allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration." The KEV entries note the flaws can be chained together.

Three details from CISA's alert matter to a small organization:

  • Old versions are affected. The listed versions are 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. Version 22.8 reaches end of life on January 31, 2027.
  • Patching may not tell you the whole story. CISA says the vendor's Integrity Checker Tool may not detect exploitation of CVE-2026-104935, because the attacker's commands run in memory.
  • Recovery is a project. For a suspected compromise, CISA points to a factory reset, an upgrade, and resetting all account passwords, including revoking and reissuing stored certificates.

Citrix tells the same story. CISA's alert on NetScaler ADC and Gateway (last revised October 9) covers critical zero-day flaws that can independently allow remote code execution. It also admits that updating these appliances "can be complex and may require downtime." That is why they get put off, and why attackers like them.

Why the edge goes first

Anyone can reach it. An internal laptop has to be found and reached first. A firewall, VPN gateway or remote-access portal answers anyone on the internet, at any hour.

One flaw can be the whole break-in. CISA, the FBI and partners' August 2026 advisory on Gunra ransomware says its actors got in "primarily through the exploitation of known vulnerabilities in internet-facing devices," including firewall and VPN appliances. In October, the same agencies' SafePay ransomware announcement said the group has hit approximately 600 victims. CISA's Chris Butera says "public-facing devices with known vulnerabilities continue to be frequently targeted."

Edge devices get forgotten. Appliances and self-hosted apps often sit outside the normal update routine. "It's been working fine for years" is how an edge device falls behind.

How CISA decides what's urgent

CISA's directive BOD 26-04 sets patch deadlines for federal agencies. It does not apply to private businesses, and CISA says so. But its logic is a good model for anyone. Urgency depends on four questions:

  1. Is the asset publicly exposed?
  2. Is the vulnerability on the KEV list?
  3. Can an attacker automate every step?
  4. Does exploitation give the attacker total control?

For small organizations, the first two do most of the work. Exposed plus KEV means move it to the top.

One more example: file sharing on the edge

On October 14, 2026, Collabora published an advisory for CVE-2026-110447 in the Built-in CODE Server app for Nextcloud. CISA added it to KEV on October 23. The advisory describes an unauthenticated flaw that lets a request run an operating-system command as the web-server user. Disabling the app is not enough: upgrade to 26.4.303 or later, or remove it. heise online reported that the first related reports in Collabora's issue tracker date to September 11, and concluded the attacks have been underway since at least then.

The point: self-hosted file sharing is internet-facing by design, so it belongs on your edge list.

Your edge-first checklist

  1. List everything that faces the internet. Firewalls, VPN gateways, remote-access portals, mail and webmail, file-sharing servers, websites and client portals, plus anything a vendor set up for you.
  2. Match the list to the KEV catalog. Search for each product name and version. Subscribe to CISA's KEV email updates.
  3. Patch KEV-listed, internet-facing items first. Then work inward.
  4. Check for compromise before and after patching. For anything on KEV, the question is not just "is it patched?" but "was it already breached?" Keep logs, and bring in an incident response contact if something looks wrong.
  5. Fix the non-patch gaps. Change default credentials and turn on account lockout. The Gunra advisory describes actors taking over an SSL-VPN appliance's administrator account through default credentials where no lockout was in place.
  6. Retire what's end-of-life. A product with no more security updates is a permanent open door.
  7. Verify from the outside. Confirm the new version is running and that nothing unexpected is still reachable. Consider an external vulnerability assessment from a qualified provider for an outside view of what is exposed.

The takeaway

You don't need to patch everything at once. You do need to know what faces the internet, and fix that first.

A free resource

For a free list of security basics, including keeping an inventory of internet-facing systems and patching known exploited vulnerabilities first, see the SMB Security Checklist.

Sources

All pages were fetched and read on November 3, 2026 (America/Denver).

This article is general information, not legal or compliance advice. Only test systems you own or have written authorization to test.