Ivanti Zero-Day Exploited in the Wild; CISA Urges Immediate Patching

· Cybersecurity · United States

CISA is urging organizations to immediately update Ivanti Connect Secure (ICS) appliances after the disclosure of a vulnerability tracked as CVE-2026-104935. The flaw is a high-severity authentication bypass combined with remote code execution that has been exploited in zero-day attacks since at least October 1. The issue was only partially discovered and patched in July, leaving a window for attackers to capitalize on. Honeypots have logged 105 exploit attempts. The incident underscores the ongoing patching challenges vendors and defenders face when vulnerabilities are incompletely fixed.

Why it matters：Incomplete patches leave enterprises exposed for months, and the active exploitation of a VPN gateway highlights how remote-access infrastructure remains a top target for attackers.

Key points

  • The flaw is an authentication bypass plus RCE, exploited since at least October 1.
  • It was only partially fixed in July, enabling ongoing attacks.
  • Honeypots have recorded 105 exploitation attempts.

Sources (original reporting)

More stories from this day