Vulnerabilities · 8h ago
Talos says CVE volume keeps climbing faster than KEV additions, and the real risk is concentrating in a small set of exploited flaws — including CVE-2026-104935 in Ivanti Connect Secure. The newsletter puts the 2026 CVE growth at 105% year over year, while KEV entries rose 37%, and says 29% of 2026 KEVs were added the same day they were published.
The Ivanti flaw is an authentication bypass in an internet-facing remote-access gateway. In plain terms, the device accepts attacker-made requests as if they were already logged in, so an attacker can reach command execution before normal login controls ever engage. For a box that brokers entry to the network, that means the gateway itself becomes the compromise point, not just the path in.
That is why the KEV backlog matters more than the raw CVE count: if your perimeter depends on login-fronting appliances, the exploited issue is the control plane you trust first. In this case, the remaining exposure sits with any Ivanti Connect Secure appliance still running below 25.1.3.0, especially where the gateway is exposed to the internet.
Published Oct 13 by Ivanti
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
1 source covering this story
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.
Part of the PlainSec briefing for 2026-10-15