Authentication Bypass in Ivanti Connect Secure (CVE‑2026‑104935) Added to CISA KEV Catalog
What It Is – Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 contain an authentication‑bypass flaw that can be triggered by spoofing. Successful exploitation lets an unauthenticated remote attacker execute arbitrary commands on the appliance.
Exploitability – The vulnerability (CVSS 8.6 High) has been observed in the wild; CISA has listed it in its Known Exploited Vulnerabilities (KEV) catalog and mandated remediation for federal agencies.
Affected Products – Ivanti Connect Secure (ICS) < 25.1.3.0 (versions 22.7R2.14 and earlier are not affected).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls and timely patching to maintain a defensible audit trail.
- Provides concrete evidence that an organization is monitoring for known‑exploited flaws, a key control objective across NIST CSF, ISO 27001 and other frameworks.
- Failure to remediate can break the chain of trust required by enterprise buyers who demand proof of up‑to‑date security posture.
Recommended Actions
- Apply Ivanti’s patch for version 25.1.3.0 or later immediately.
- Verify the running version via asset inventory and confirm remediation in logs.
- Capture remediation evidence (patch tickets, configuration snapshots) and map the activity to your vulnerability‑management control objective.
- Update your continuous monitoring rules to flag any re‑introduction of the vulnerable version.