Incomplete Ivanti ICS Patch Opened Door to Zero-Day Attacks
A high-severity flaw in Ivanti ICS, identified as CVE-2026-104935, combines an authentication bypass with remote code execution. The vulnerability was only partly found and fixed in July, according to the report. Attackers have since been able to take advantage of the remaining exposure.
The case centers on CVE-2026-104935, a high-severity Ivanti ICS issue that links an authentication bypass with remote code execution. A July remediation effort addressed only part of the problem, according to the report. That left residual exposure, which attackers have since exploited. The episode illustrates how incomplete fixes can preserve a path for zero-day attacks even after vendors respond.
Organizations using Ivanti ICS could face unauthorized access or remote code execution, potentially disrupting operations or exposing sensitive data. Security teams may need to verify whether earlier fixes fully closed the flaw and watch for signs of compromise. If affected systems support essential services, disruptions could ripple outward to customers or the public. The incident may also reinforce broader caution about relying on partial patches for critical security flaws.