Vulnerabilities · 1 day ago
Talos says CVE-2026-104935 in Ivanti Connect Secure is being exploited as a zero-day, with CISA setting a same-day remediation deadline of 2026-10-16. Ivanti has a fixed release, 25.1.3.0 or later, for the affected VPN gateway.
The flaw lets an attacker make the device believe a login succeeded when it did not, so the gateway accepts commands as if they came from an authenticated user. That matters because the appliance sits in front of the internal network; once it trusts the attacker, password and MFA checks are already out of the picture.
For organizations that use VPN appliances as the front door, the exposure is not just one box going bad. A compromise at the gateway can become a route into whatever that gateway is allowed to reach, which is why this belongs in the same bucket as perimeter trust, not ordinary server hygiene.
Published Oct 13 by Ivanti
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
1 source covering this story
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.
Part of the PlainSec briefing for 2026-10-16