CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Cyberiack

Skip to content

Actively exploited: added to CISA’s KEV catalog on October 13, 2026.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: October 16, 2026.
CERT-FR alert CERTFR-2026-ALE-013 of October 14, 2026.

Description from CISA’s KEV catalog.

Our analyses

Ivanti Connect Secure zero-day exploited, one of the patches still pending

Ivanti has patched CVE-2026-104935, exploited since early October on its VPN gateways. But the attack chain also relies on a privilege escalation flaw that remains unpatched.

Oct 13, 20262 min read

CERT-FR alerts and notices

CERTFR-2026-ALE-013Oct 14

Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)

What to do

Check whether your estate includes Ivanti Connect Secure, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Other Ivanti vulnerabilities

All exploited Ivanti vulnerabilities