Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

A high-severity vulnerability in Ivanti ICS, identified as CVE-2026-104935, allows for authentication bypass and remote code execution. This issue was only partially addressed in a July patch, leaving a remaining vulnerability that threat actors can exploit. The incomplete patching of this flaw has created an opportunity for attackers to launch zero-day attacks. The vulnerability's partial discovery and patching in July highlights the challenges vendors face in fully resolving security issues. Threat actors are taking advantage of the remaining vulnerability, posing a risk to affected systems.