Ivanti Security Advisory · October 2026

    IvantiScheduled

    1

    Total

    Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.

    0

    Critical

    CVEs with CVSS 9.0 or higher (critical per NVD scale).

    1

    Zero-day

    Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).

    1

    KEV

    Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.

    1 zero-day / actively exploited

    These vulnerabilities were exploited before or at the time the patch was released. Install the related updates first.

    1 zero-day / actively exploited
    HighCVE-2026-104935

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

    Listed in CISA KEV

    		—8.6