GoKawiil
Tech News
A high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS, tracked as CVE-2026-104935, was only partially fixed when Ivanti issued a patch in July. Threat actors have since exploited the remaining gap, according to reports, allowing attacks to continue despite the earlier remediation attempt.
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.
Ivanti has issued an urgent patch advisory for CVE-2026-104935, a high-severity authentication bypass flaw in its Connect Secure VPN gateway that is being actively exploited. The vulnerability, discovered by Volexity, affects multiple recent ICS versions and lets unauthenticated attackers run arbitrary commands without user interaction. Shadowserver reports more than 5,500 ICS instances currently exposed online.