CISA urges immediate patching of Ivanti Connect Secure flaw exploited as zero-day

Situation Overview

On 14 October, the US Cybersecurity and Infrastructure Security Agency (CISA) urged administrators to immediately patch Ivanti Connect Secure (ICS) appliances and deployments after a vulnerability tracked as CVE-2026-104935 was actively exploited as a zero-day. CISA said exploitation has been observed since at least 1 October and that the flaw is an authentication bypass affecting ICS, with a CVSS score of 8.6. The agency’s guidance focuses on taking immediate update and mitigation steps to reduce exposure. The reports also note that honeypots logged 105 exploit attempts, indicating continued scanning and attempted exploitation activity following the public disclosure and CISA’s warning.

Geopolitical Implications

1. 01

   Targets perimeter and remote-access infrastructure, raising risk of wider enterprise and government network compromise.

2. 02

   CISA’s rapid guidance signals an active, time-sensitive threat.

Key Signals

• —

  Whether CISA issues further version-specific guidance for CVE-2026-104935.

• —

  Patch adoption progress for Ivanti Connect Secure after the 14 October warning.

Topics & Keywords

Market Impact Analysis

AI Threat Assessment

Event Timeline