Threat Intelligence

Incomplete Ivanti Patch Leaves Door Open for Attackers

Dark Reading · 15 Oct 2026

Key Takeaway If your business uses Ivanti ICS, check the vendor's latest advisory today and apply any follow-up updates, rather than assuming the July patch fully fixed the problem.

A serious vulnerability in Ivanti Connect Secure (ICS) products, tracked as CVE-2026-104935, is being used in attacks after a patch released in July only partly addressed it. Dark Reading reports that the flaw was only partially discovered and fixed at that time.

The vulnerability is rated high severity and combines two problems: an authentication bypass, which lets an attacker skip the login process, and remote code execution (RCE), which lets them run their own commands on an affected system. Because ICS devices sit at the edge of a network and handle remote access, weaknesses like this are especially attractive to attackers.

The case highlights a wider challenge for vendors, where an incomplete fix can give businesses a false sense of security while attackers continue to find a way in. The source summary does not provide further technical detail, so organisations using Ivanti ICS should check Ivanti's latest advisories for current guidance.

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.