Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935) is being actively exploited, CISA warns
CISA added CVE-2026-104935 (Ivanti Connect Secure) to its Known Exploited Vulnerabilities catalog on October 13, 2026, which means there is reliable evidence of exploitation in the wild. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Enterprises
Affected technology: Ivanti Connect Secure / EPMM
Why it matters
CISA lists this as exploited in the wild. Unpatched Ivanti Connect Secure / EPMM systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for Ivanti Connect Secure / EPMM. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
CISA's required action for CVE-2026-104935: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by October 16, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Treat this as an emergency.
Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT).
SAP warns of maximum severity OAuth2 SSRF security flaw
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
Apply the vendor's security update for the affected products.