Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Summary
Attackers are exploiting an authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure appliances, allowing them to gain access without legitimate accounts. The flaw enables arbitrary command execution on compromised devices, and CISA has added it to its Known Exploited Vulnerabilities catalog.
IFF Assessment
The vulnerability allows attackers to bypass authentication and gain unauthorized access, posing a significant risk to organizations using the affected Ivanti Connect Secure appliances.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 16, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability is critical for defenders as it bypasses standard authentication mechanisms, allowing unauthenticated access and subsequent command execution. Organizations using Ivanti Connect Secure must prioritize patching and investigate for signs of compromise due to its inclusion on the CISA KEV catalog.