GoKawiil
Tech News
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.