Ivanti VPN bug added to US 'actively exploited' list - but the detail is thin

What we actually know

A new flaw tracked as CVE-2026-104935, affecting Ivanti’s Connect Secure VPN appliance, was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue on 13 October 2026. That listing exists for one reason only: CISA requires evidence that a bug is being exploited in the real world before it goes on the list, not just that one is theoretically possible. So the “actively exploited” tag here isn’t hype — it’s the whole point of the catalogue.

What’s noticeably absent, at least in the public record checked for this piece, is almost everything else. The NVD entry carries the CVE number but, as of writing, no published description, CVSS severity score or technical breakdown of how the flaw works — whether it’s a remote code execution hole, an authentication bypass, or something else entirely. CISA’s own guidance simply tells agencies to “apply mitigations in accordance with vendor instructions,” without linking a specific Ivanti advisory in the material available. In short: the exploitation is confirmed, the mechanics are not yet public.

So who is actually at risk

Connect Secure is not a consumer product. It’s the enterprise-grade VPN gateway that organisations — government departments, universities, large businesses — use to let staff connect securely into internal networks from outside. If you’ve never heard of it, that’s because you’re not supposed to; it sits on the edge of a company’s infrastructure, managed by IT teams, not end users.

That means this isn’t a story about your home router or your phone. Nobody with a personal broadband connection or a consumer VPN subscription needs to do anything differently. The people who need to care are system administrators responsible for Ivanti Connect Secure deployments, and by extension the organisations — and their customers — whose data sits behind those gateways.

CISA’s entry lists the ransomware status for this CVE as “Unknown,” meaning there’s no confirmed link, yet, between this flaw and ransomware crews piggybacking on it. That’s worth noting precisely because Ivanti’s edge appliances have a track record of being popular targets once a working exploit circulates, so it’s a detail worth watching rather than dismissing.

What to do about it

For federal US agencies, the instruction is blunt: patch or mitigate by 16 October 2026, under CISA’s Binding Operational Directive process — a three-day window from the date the bug was added to the list, which signals how seriously the agency is treating it even without public technical detail.

For everyone else running Connect Secure — UK organisations included, since CISA’s KEV list is watched globally as a de facto industry standard — the sensible move is the boring one: check Ivanti’s own advisory channels for a patch or mitigation, verify it against the specific CVE, and apply it rather than waiting for a fuller public post-mortem that may arrive later, if at all.

The takeaway

This is a real, confirmed-in-the-wild vulnerability in enterprise VPN kit, not a speculative research finding — but the public record is unusually sparse on specifics right now. If you’re not an IT administrator managing Ivanti’s gateway products, there’s nothing to do here. If you are, the deadline that matters isn’t CISA’s for US federal bodies — it’s whenever Ivanti ships a fix, and that’s worth chasing down directly rather than waiting for the headline to fill in the gaps.