CISA Adds Critical Ivanti Connect Secure Flaw to Exploited Vulnerabilities Catalog
Federal agencies must patch an actively exploited authentication bypass bug allowing remote execution.
1CISA Expands Vulnerability Catalog
The Cybersecurity and Infrastructure Security Agency added an Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-104935 with a CVSS score of 8.6, this high-severity bug represents an immediate operational threat to enterprise network perimeters across public and private sectors.
2Authentication Bypass Architecture
The security flaw stems from an authentication bypass caused by spoofing mechanisms in ICS software. Unauthenticated remote threat actors can bypass established gateway access controls. This mechanism ultimately allows unauthorized attackers to execute arbitrary system commands directly on underlying target appliances without valid credentials.
3Affected Software Versions Identified
The vulnerability directly affects specific Ivanti Connect Secure builds released before version 25.1.3.0. Official security advisories clarify that legacy ICS versions 22.7R2.14 and earlier remain unaffected by this defect. Infrastructure teams must identify specific installed software versions across their perimeter gateway deployments immediately.
4Active In-The-Wild Attacks
Ivanti publicly confirmed that malicious actors have already weaponized this flaw in targeted production environments. Active exploitation was observed impacting a limited number of customers prior to disclosure. The discovery of active abuse triggered emergency remediation advisories to prevent broader lateral network infiltration campaigns.
5Federal Directive Mandates Remediation
Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies face mandatory remediation requirements. Agencies must identify vulnerable internet-facing endpoints and apply official vendor updates. CISA explicitly ordered federal entities to remediate the vulnerability across enterprise network assets by October 16, 2026.
6Private Sector Exposure Dynamics
Although CISA directives legally bind only federal civilian agencies, cybersecurity experts urge commercial enterprises to follow identical timelines. Edge appliances like VPN gateways remain prime targets for initial access brokers. Private sector organizations must audit their external attack surface to isolate unpatched gateway hardware.
7Vendor Mitigation Strategies Released
Ivanti released security updates targeting Ivanti Connect Secure to neutralize the spoofing vector. System administrators must upgrade immediately to version 25.1.3.0 or later releases. Organizations unable to patch instantly should review appliance access logs for anomalous outbound connections and unexpected administrative account activities.
8Strategic Perimeter Defense Implications
This disclosure highlights the continuing operational risks surrounding critical enterprise perimeter infrastructure. Remote command execution vulnerabilities on edge devices bypass internal network segmentation entirely. Security leaders must combine rapid patch deployment with continuous credential auditing, strict access policies, and enhanced telemetry monitoring across all endpoints.