Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
BLUF
A partially patched Ivanti ICS zero-day is being actively exploited, underscoring the risk of incomplete vendor fixes.
NEWS
CVE-2026-104935 is a high-severity authentication bypass and remote code execution vulnerability in Ivanti ICS. It was only partially discovered and patched in July, leaving an exploitable gap that threat actors have used in zero-day attacks. The incident highlights how incomplete vendor patching can prolong exposure even after a fix is announced.
Why I Care
Organizations running Ivanti ICS face direct risk of unauthorized access and remote code execution, which can lead to data theft, lateral movement, and operational disruption. The issue also raises broader concerns about supply-chain trust and the effectiveness of vendor disclosure and patch validation processes.
Next Steps
Security teams should immediately verify whether they use Ivanti ICS, apply all available patches or mitigations, validate that the July fix fully closes CVE-2026-104935, monitor for exploitation indicators, and escalate to vendor support if incomplete. CISOs and IT operations should prioritize emergency patching for internet-facing systems within 24 hours and review incident response readiness.
Source: Dark Reading ·