Ivanti on CuraSec

CISA KEV: Ivanti Connect Secure Auth Bypass CVE-2026-104935 Actively Exploited

Wed, 14 Oct 2026 15:48:57 +0000

Engineer — Act: CVE-2026-104935 is CISA KEV-listed with a public GitHub PoC and confirmed honeypot exploitation — if you run Ivanti Connect Secure, patch to the latest version immediately and audit authentication logs for anomalous access patterns prior to patch deployment.
SOC/IR — Act: Active exploitation of an edge VPN appliance warrants an assume-breach posture — hunt for anomalous authentication events on ICS gateways since disclosure, and sweep for lateral movement indicators originating from VPN-assigned IPs, particularly over the past week.
Leader — Act: A CISA KEV-listed authentication bypass in a widely deployed enterprise VPN with confirmed active exploitation is a material risk event — confirm whether Ivanti Connect Secure is in your environment, verify patching is escalated to this week, and prepare a brief for leadership if it is deployed.
Signals: CVE-2026-104935 — CISA KEV: listed, EPSS 0.26, public PoC on GitHub

Wed, 14 Oct 2026 15:48:57 +0000

Engineer — Act: Ivanti Connect Secure is a widely deployed VPN appliance now under active zero-day exploitation; patch immediately and audit device logs and downstream network activity for signs of pre-patch compromise going back to October 1.
SOC/IR — Act: Active exploitation of an edge VPN appliance demands an assume-breach posture — hunt for lateral movement or credential harvesting originating from ICS appliances in your estate since at least October 1, and check for anomalous outbound sessions from those hosts.
Leader — Act: A CISA emergency advisory on a widely used VPN product with confirmed zero-day exploitation since October 1 warrants a same-week check: confirm whether Ivanti Connect Secure is in your environment, verify patch status with your team, and be ready to brief leadership if a breach window is identified.

Tue, 13 Oct 2026 18:14:34 +0000

Engineer — Act: Ivanti Connect Secure is a common enterprise VPN gateway with a history of nation-state targeting; active exploitation with a vendor-issued patch means patch immediately per Ivanti’s advisory and audit appliance logs for signs of pre-patch compromise.
SOC/IR — Act: Active exploitation of an edge VPN appliance warrants an assume-breach sweep: hunt for unauthorized sessions, anomalous authentication events, or lateral movement originating from ICS gateway IPs since the vulnerability’s disclosure window.
Leader — Act: A zero-day in a widely-deployed remote access gateway being actively exploited is a board-question-level event; confirm this week whether ICS is in your environment, verify patching is under way, and assess whether any compromise could trigger SEC or GDPR notification obligations.