CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
The sixth exploited Ivanti bug this year drew attention from the feds and researchers, while a severe Microsoft vulnerability was one of more than 1,400 listed for Patch Tuesday.
Excerpt from the primary source: The Record by Recorded Future News
Who is affected
Enterprises
Affected technology: Ivanti Connect Secure / EPMM
Why it matters
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for Ivanti Connect Secure / EPMM. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Treat this as an emergency.
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products
Critical-severity flaws could lead to authentication bypass, code execution, and sensitive authentication information leaks.
Apply the vendor's security update for FortiGate / FortiOS and Ivanti Connect Secure / EPMM.
Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Treat this as an emergency.
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935) is being actively exploited, CISA warns
CISA added CVE-2026-104935 (Ivanti Connect Secure) to its Known Exploited Vulnerabilities catalog on October 13, 2026, which means there is reliable evidence of exploitation in the wild. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CISA lists this as exploited in the wild. Unpatched Ivanti Connect Secure / EPMM and Windows systems are exposed to active attacks now.
Treat this as an emergency.