Vulnerabilities & Exploits

Ivanti fixes seven flaws as Connect Secure is exploited

Ivanti said on Oct. 14 it fixed seven vulnerabilities across Connect Secure, Xtraction, and Neurons Patch for Intune, and confirmed active, limited exploitation of CVE-2026-104935 in Connect Secure. The cloud Neurons issue was already auto-updated on Sept. 16, narrowing the practical exposure to on-premises systems that had not moved to the fixed builds.

The exploited Connect Secure flaw is an authentication-bypass-by-spoofing bug: an attacker can make the appliance accept them as trusted before the normal login gate has a chance to stop them. Ivanti also said one Xtraction flaw could let a remote authenticated user redirect requests and pull connector credentials, while another Neurons issue could expose authentication secrets.

For teams running these products, the main risk now sits where the gateway stands in front of remote access: an unpatched Connect Secure box is the boundary itself, not just an app behind it. Xtraction and on-prem Neurons deployments carry their own exposure, but the reporting leaves the cloud tenant issue as already remediated.

2 sources · 7h ago

CVE-2026-104935

NVD KEV

Known exploited · CISA KEV

CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

CISA federal remediation date Oct 16

CVE-2026-106042

NVD KEV

CVSS 9.9 CRITICAL: an External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote…

CVE-2026-109412

NVD KEV

CVSS 9.9 CRITICAL: an exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak…

Timeline

Sources

Vendor digest: Ivanti

Part of the PlainSec briefing for 2026-10-14

Every edition of this story: Ivanti fixes seven flaws as Connect Secure is exploited

More from today