Zero‑Day Authentication Bypass & RCE in Ivanti ICS (CVE‑2026‑104935) Underscores Patch‑Management Gaps
What It Is – A newly disclosed CVE‑2026‑104935 combines an authentication‑bypass flaw with remote‑code execution in Ivanti’s Industrial Control Systems (ICS) management suite. The vulnerability is rated high‑severity and was only partially mitigated in the July 2024 patch.
Exploitability – Public proof‑of‑concept code has been observed in the wild; threat actors can exploit the auth‑bypass to execute arbitrary commands on vulnerable controllers.
Affected Products – Ivanti ICS Server 7.x and associated agent components used to manage PLCs, HMIs, and other field devices.
Why It Matters for Trust & Control Assurance
- Patch‑management controls: The partial fix highlights the need for continuous verification that vendor patches are fully applied across all environments.
- Third‑party oversight: Demonstrating due diligence on a critical vendor requires auditable evidence that remediation timelines are met.
- Defensible audit trail: Real‑time logging of patch status and remediation actions supplies the documentation auditors expect for control‑objective compliance.
Recommended Actions
- Inventory every Ivanti ICS instance and confirm the July 2024 patch is fully applied.
- Deploy an automated vulnerability‑scanning tool that validates patch compliance on a daily basis.
- Incorporate the patch‑status feed into your third‑party risk program to generate continuous evidence of vendor oversight.
- Document remediation steps in a centralized audit repository for future assessments.
Source: Dark Reading – Ivanti ICS Zero‑Day Attacks Highlight Vendor Patching Hurdles