CISA has urged organisations to update Ivanti Connect Secure appliances immediately after the disclosure of an actively exploited vulnerability affecting the remote access product. The flaw, tracked as CVE-2026-104935, has been described as an authentication bypass issue, meaning attackers may be able to gain access without valid credentials under certain conditions.

While the warning comes from a U.S. cybersecurity agency, the practical risk is broader. Ivanti Connect Secure is used by organisations to provide VPN and secure remote access, so any actively exploited weakness in this type of system is relevant to European businesses that rely on external access for staff, suppliers and IT administration.

What happened

According to the source report, CISA called on organisations to move quickly to the latest available version of Ivanti Connect Secure after public disclosure of the vulnerability and signs of active exploitation. The issue is identified as CVE-2026-104935 and carries a reported CVSS severity score of 8.6.

The reported weakness affects Ivanti Connect Secure, often deployed as an internet-facing access gateway. Because the issue involves authentication bypass, the main concern is that attackers may be able to circumvent normal login controls. The source also references honeypot activity showing repeated exploit attempts, which indicates that scanning and attack activity began quickly after disclosure.

At this stage, businesses should distinguish between confirmed facts and broader assumptions: the vulnerability has been disclosed, active exploitation has been reported, and CISA has advised immediate updating. Companies should rely on vendor and official security guidance for version-specific remediation details and indicators of compromise.

Why it matters for European businesses

For many businesses, VPN and remote access appliances sit at the edge of the network and are reachable from the internet. That makes them especially attractive targets. If an attacker can bypass authentication on such a system, the result may be far more serious than a normal software bug because the device often acts as a gateway into internal systems.

For European organisations, the business impact can include:

• Operational disruption if remote access must be restricted or emergency maintenance is required.
• Higher breach risk where the appliance connects users to internal applications, file systems or administrative environments.
• Compliance exposure if compromise leads to unauthorised access to personal data, regulated systems or customer information.
• Third-party risk if service providers, contractors or managed IT teams use the same access infrastructure.

This is particularly important for companies balancing hybrid work, outsourced IT support and cloud-connected infrastructure. A weakness in the access layer can affect not only employees but also partners and support providers who depend on that connection path.

Who may be affected

The most directly affected organisations are those running Ivanti Connect Secure appliances or deployments in production. This may include:

• SMEs using Ivanti for staff VPN access.
• Mid-sized businesses with centralised remote access for multiple offices.
• E-commerce and digital businesses where administrators connect remotely to backend systems.
• IT teams and managed service providers supporting customer environments through Ivanti infrastructure.
• Businesses in regulated sectors where secure access controls are subject to stricter governance and incident response expectations.

Even companies that do not manage the product directly may still be exposed if a hosting provider, MSP or parent company operates the affected appliance on their behalf.

What companies should consider

• Identify exposure quickly. Confirm whether your organisation uses Ivanti Connect Secure in any environment, including production, disaster recovery and supplier-managed deployments.
• Apply vendor-recommended updates. Follow Ivanti's official remediation guidance and validate that systems are updated to the latest recommended version.
• Review internet-facing access points. Check whether the appliance is publicly reachable and whether access can be temporarily limited while patching and verification take place.
• Examine logs and monitoring data. Review authentication activity, administrative events and network access records for unusual behaviour, especially around the period following public disclosure.
• Engage external providers. If an MSP, security partner or infrastructure supplier manages the appliance, request confirmation of patch status and any compromise checks performed.
• Prepare for incident response. If suspicious activity is found, escalate promptly, preserve logs and assess whether internal systems or data may have been accessed through the gateway.
• Reassess patching priority for edge systems. Internet-facing security appliances often require faster update cycles than standard internal software because attackers move quickly once exploits become available.

For European businesses, the immediate lesson is not only to patch a specific product but to treat remote access infrastructure as high-priority attack surface. When active exploitation is reported on edge devices, delayed updates can quickly become a business continuity and data protection issue.