Connect Secure - GoKawiil

CISA orders federal agencies to patch actively exploited Ivanti Connect Secure flaw

CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.

bleepingcomputer.com · 2026-10-14

Ivanti patches Connect Secure zero-day already under attack

Ivanti has issued an urgent patch advisory for CVE-2026-104935, a high-severity authentication bypass flaw in its Connect Secure VPN gateway that is being actively exploited. The vulnerability, discovered by Volexity, affects multiple recent ICS versions and lets unauthenticated attackers run arbitrary commands without user interaction. Shadowserver reports more than 5,500 ICS instances currently exposed online.

bleepingcomputer.com · 2026-10-13