GoKawiilCISA orders federal agencies to patch actively exploited Ivanti Connect Secure flaw
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's low complexity and lack of required user interaction make it especially attractive to attackers targeting edge VPN appliances, which have repeatedly been a favored entry point into enterprise networks. With over 5,600 internet-exposed ICS hosts identified by Shadowserver, the scale of potential exposure suggests organizations that delay patching could face credential theft or deeper network compromise.
- CISA is urging immediate patching of CVE-2026-104935, an actively exploited Ivanti Connect Secure flaw.
- Volexity found attackers chaining the bug with two other vulnerabilities to achieve unauthenticated root-level access and steal credentials.
- Over 5,600 internet-exposed ICS hosts remain, though it's unclear how many are patched or vulnerable.
Source: bleepingcomputer.com, 2026-10-14
Published there as: “CISA warns admins to immediately fix Ivanti flaw exploited as zero-day”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.