Fresh from the source

Ivanti Connect Secure flaw added to the list of vulnerabilities attackers are using

On 13 October 2026, CISA added a flaw in Ivanti Connect Secure (CVE-2026-104935) to its Known Exploited Vulnerabilities Catalog. A flaw is listed there only when attackers are already using it.

Released by CISA Known Exploited Vulnerabilities Catalog. We read it on .

Check my firmWhat to check
01

What does the source say?

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

02

What does it mean for a small firm?

This kind of device sits between a firm's network and the internet, so a flaw in it can be a way in from the internet. When a flaw is on this list, attackers are already using it in real attacks, not only in a laboratory. A firm that has not installed the maker's update is open to a working attack.

The agency gave US federal agencies until 16 October 2026 to apply the fix.

03

What should I check?

  1. Find out whether your firm uses Ivanti Connect Secure. The label on the device, or the title of its admin login page, names it.
  2. If it does, open the maker's own security notice for the flaw and install the update it names.
  3. Check that the device's admin screen cannot be reached from the open internet. If it can, limit it to your own network.
  4. After the update, confirm that the version number the device shows matches the one in the maker's notice.

Some of this can be seen from outside a firm, from its public side. Some cannot, such as the inside of a device or an account. What we cover lists both. What we cover

Sources

Where does this come from?

All fresh pagesWhat we cover
04 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy