GoKawiilIvanti ICS flaw CVE-2026-104935 exploited after incomplete July patch
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests that vendor patches addressing complex authentication and RCE flaws can leave residual attack surface if not fully validated before release. It raises questions for organizations relying on Ivanti ICS about whether applying a vendor patch is sufficient assurance of security, or whether additional verification and monitoring are needed.
- CVE-2026-104935 combines authentication bypass with remote code execution in Ivanti ICS
- Ivanti's July patch did not fully close the vulnerability
- Attackers have exploited the incomplete fix, highlighting risks in vendor patch processes
Source: darkreading.com, 2026-10-14
Published there as: “Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.