CISA urges immediate patching of exploited Ivanti Connect Secure zero-day
An unauthenticated command execution flaw in a remote access gateway is already a breach path, so patching alone is not enough. Organisations running affected versions should treat credentials that passed through the appliance as potentially exposed, rotate them, and review gateway and downstream logs for exfiltration. Boards should also ask how quickly perimeter appliances can be patched outside normal change windows, because exploitation here began before disclosure.
What Happened
On 13 October 2026, CISA said threat actors are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands, to steal credentials and exfiltrate data. Affected versions are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day and urged organisations to update immediately.
Why It Matters
An unauthenticated command execution flaw in a remote access gateway is already a breach path, so patching alone is not enough. Organisations running affected versions should treat credentials that passed through the appliance as potentially exposed, rotate them, and review gateway and downstream logs for exfiltration. Boards should also ask how quickly perimeter appliances can be patched outside normal change windows, because exploitation here began before disclosure.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (2026-10-13)
More From This Briefing
- Microsoft unveils Maia 300 and plans to make in-house chips its primary inference system
- FERC approves PJM data centre registry but rejects plan to curtail grid power to data centres
- Meta releases Muse Wonder, its first frontier-class paid AI model
- NTT Data in final talks to build Anthropic's first dedicated Japan data centre, Nikkei reports
This story is part of the Laurenceo Intelligence briefing for 14 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.