Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release.

Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog Pierluigi Paganini October 13, 2026 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of

Ivanti Connect Secure Ships Authentication That Can Be Spoofed. CISA Says Thursday.

The perimeter has authentication. The authentication can be spoofed. Effective today, the CVE-2026-104935 record documents a vulnerability in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands on the VPN appliance without providing credentials. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Federal agencies have until Thursday. The […]