Ivanti Zero-Day Exploited Since October 1, CISA Sets 48-Hour Federal Deadline

Ivanti Connect Secure zero-day enables command execution without credentials

CISA warned on October 14 that attackers had exploited CVE-2026-104935 in Ivanti Connect Secure since at least October 1. The high-severity authentication-bypass flaw requires no credentials or user interaction and enables arbitrary command execution, credential theft, and data exfiltration.

CISA directed federal civilian agencies to remediate by October 16 under Binding Operational Directive 26-04 and urged all organizations to patch immediately. For suspected compromise, CISA recommends rebuilding affected virtual appliances or factory-resetting physical appliances, then resetting passwords, certificates, API keys, and license credentials.

This is the 36th Ivanti vulnerability CISA has added to its actively exploited list since November 2021. Twelve have also been used in ransomware attacks.

The incident increases pressure on buyers to reduce internet-facing appliance exposure and add independent identity, segmentation, and endpoint telemetry around remote-access infrastructure. Ivanti competes with VPN and zero-trust access providers including Palo Alto Networks, Cisco, Fortinet, Zscaler, and Cloudflare.

Organizations should treat patching as insufficient if compromise is possible. Procurement teams may need emergency incident-response retainers, appliance replacement or migration budgets, and controls that detect credential theft and lateral movement after a perimeter-device breach.

CISA adds Palo Alto, Cisco, and Ahsay flaws with October 17 federal deadline

CISA added four vulnerabilities on October 15 and set a federal remediation deadline of October 17:

- Palo Alto Networks PAN-OS — CVE-2026-0322: high-severity remote code execution in the management interface - Cisco Secure Email Gateway — CVE-2026-76519: critical relative path traversal flaw that lets an attacker write arbitrary files and execute commands with root privileges via crafted email attachment - Ahsay AhsayCBS — CVE-2026-105133 and CVE-2026-105134: authentication and critical command-injection flaws

Ahsay confirmed that some operators remained exposed even after installing earlier patches. Attackers were planting web shells and cryptominers on internet-facing servers.

Buyers should prioritize exposure-based remediation rather than vendor-wide patch campaigns. Internet-facing management interfaces, email gateways, and backup servers warrant emergency asset discovery, external scanning, privileged-account review, and immutable-backup validation.

Backup infrastructure is a particularly high-value control plane. Compromise can support both extortion and recovery sabotage. Enterprises may need separate backup credentials, network isolation, and additional monitoring rather than relying solely on the backup vendor's patch cycle. Ahsay competes with Veeam, Commvault, and other backup platforms. Palo Alto competes with Fortinet and Cisco in network security. Cisco Secure Email Gateway competes with Microsoft Defender for Office 365, Proofpoint, and Mimecast.

China-linked actors exploit legacy infrastructure flaws dating to 2015

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, including ProFTPD CVE-2015-3306 (CVSS 10.0), ONLYOFFICE Docs CVE-2021-3199 (CVSS 9.8), Apache Struts CVE-2016-3081 (CVSS 8.1), ISC BIND CVE-2015-5477 (CVSS 7.5), and Strapi CVE-2023-22894 (CVSS 7.2).

CISA-linked reporting associates the broader activity with China-linked actors using automated scanning, large botnets, and hands-on exploitation to target organizations worldwide, including critical infrastructure.

The use of flaws dating back to 2015, 2016, and 2021 demonstrates that attackers continue to monetize unremediated legacy systems. Buyers should measure remediation service-level agreements against CISA KEV deadlines and inventory completeness, not merely annual penetration-test results.

The main purchasing issue is vulnerability-management maturity. Enterprises with unsupported or embedded legacy software may need application modernization, managed hosting, virtual patching, or compensating controls. A high CVSS score alone is less actionable than confirmed exploitation and internet exposure.

Microsoft and Atlassian vulnerabilities added to KEV catalog

Microsoft's October monthly security rollup included CVE-2026-96951, which Microsoft identified as exploited. CISA added it to the KEV catalog on October 13.

CISA also added CVE-2026-21589, a CVSS 9.3 unauthenticated arbitrary file-read and path-traversal vulnerability affecting Atlassian Data Center products including Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. The reported federal remediation deadline was October 18.

Enterprises should verify whether the affected Microsoft products are present in high-value identity, endpoint, or server roles and whether patch deployment telemetry is complete. Buyers may need to fund better asset inventory, emergency patch orchestration, and identity-threat detection rather than adding another standalone dashboard.

What to watch

The clustering of perimeter, infrastructure, and collaboration-platform flaws in a single week creates compounding risk for organizations with incomplete asset inventories or slow patch cycles. The remediation deadlines ranged from 48 to 96 hours for federal agencies.

Enterprises should prioritize internet-facing exposure and privileged-access infrastructure over severity scores alone. The recurrence of Ivanti vulnerabilities and the exploitation of decade-old flaws signal that vendor patch quality and legacy-system lifecycle management are purchasing decisions, not merely operational ones.