Skip to content
Sign in

Ivanti product

Connect Secure

Alert
No CISA KEV deadline is open. CISA last added a Connect Secure CVE on 13 Oct.

Tracked since 13 Oct · latest article 30 Oct · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date1

Connect Secure CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Connect Secure CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-104935Connect Secure13 OctPassed 16 Oct16
Vendor CSV of 36 entries for IvantiAll 36 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Connect Secure CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’260Q3 ’261Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20261

Fix listed

1 of 2 CVEs in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-104935: 99.7th percentile, in CISA KEVCVE-2026-111357: 16th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-10493599.7
CVE-2026-11135716

Coverage16 articles · all time

The latest 16 articles naming Connect Secure, in the shared story grammar.

Full timeline
Developinglatest 2 hours ago16 articles7 outlets

16 articles from 7 outlets since 13 Oct. Picked up again today after 13 days quiet.

Now13 Oct151617First reportCISA · 13 Oct, 15:32Picked up againafter 13 days quiet
  • Tue 13 Oct, 15:32 UTC. CISA, first report. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 16:27 UTC. SecurityOnline, its first report on the story. Ivanti Connect Secure flaw bypasses authentication in active attacks. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:48 UTC. Security Affairs, its first report on the story. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:49 UTC. SecurityWeek, its first report on the story. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. The Hacker News, its first report on the story. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. SecurityOnline. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 21:14 UTC. Rapid7, its first report on the story. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day.
  • Wed 14 Oct, 08:01 UTC. SecurityOnline. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 10:27 UTC. Security Affairs. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 11:01 UTC. SecurityOnline. Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 12:50 UTC. The Hacker News. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 21:41 UTC. Security Affairs. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 22:17 UTC. Dark Reading, its first report on the story. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 20:58 UTC. Dark Reading. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 04:30 UTC. SecurityOnline. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Tue 13 OctDay 07
    1. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution15:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. Ivanti Connect Secure flaw bypasses authentication in active attacks16:27 · SecurityOnline · Known exploited CVE
    3. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution18:48 · Security Affairs · Known exploited CVE
    Show 4 more from 13 Oct
    1. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials18:49 · SecurityWeek · Known exploited CVE
    2. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In19:25 · The Hacker News · Known exploited CVE
    3. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs19:25 · SecurityOnline · Known exploited CVE
    4. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive21:14 · Rapid7 · Known exploited CVE
  2. Wed 14 OctDay 17
    1. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day08:01 · SecurityWeek
    2. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery08:01 · SecurityOnline · Known exploited CVE
    3. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access10:27 · Security Affairs · Known exploited CVE
    Show 4 more from 14 Oct
    1. Microsoft Ends Windows 11 24H2 Support for Consumers in October 202611:01 · SecurityOnline · Known exploited CVE
    2. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks12:50 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections21:41 · Security Affairs · Known exploited CVE
    4. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched22:17 · Dark Reading · Known exploited CVE

  3. Quiet for 2 days

    Fri 16 OctDay 31
    1. China-linked hackers exploited BeyondTrust zero-day to steal credentials20:58 · Dark Reading · Known exploited CVE

  4. Quiet for 13 days

    Fri 30 OctDay 171
    1. Ivanti Connect Secure flaws exploited in zero day attacks04:30 · SecurityOnline · Picked up again · Known exploited CVE

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-104935Exploited

    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

    8.6High87% EPSS · 16 articles
  • CVE-2026-111357

    Ivanti Connect Secure vulnerability

    7.0High0.3% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in