CVE-2026-104935
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
Vulnerabilities · 3h ago
CISA said Tuesday that attackers are actively exploiting CVE-2026-104935 in Ivanti Connect Secure, an authentication-bypass flaw in ICS versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The agency added it to its Known Exploited Vulnerabilities catalog and set an October 16, 2026 deadline for federal civilian agencies.
The bug lets a remote unauthenticated attacker reach command execution on the appliance. CISA says that foothold is already being used for credential theft and data exfiltration, and Previdian reported 105 exploit attempts against honeypots by October 14, from 50 IPs tied to Singapore and the U.S.
Because the target is a remote-access gateway, the exposure is not confined to the box itself: if the appliance sits in front of internal systems, whoever controls it can pivot into the network it protects. For operators on older branches, the hard part may be migration and compatibility, while the trust hit can outlast the patch.
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
3 sources covering this story
Hacker targets Ivanti Connect Secure in chained exploitation
Researchers warn the attacker is taking multiple steps to clean up forensic evidence after an attack.
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA says attackers are exploiting an Ivanti Connect Secure authentication bypass to execute commands, steal credentials, and exfiltrate data.
Part of the PlainSec briefing for 2026-10-14