Ivanti Connect Secure multiple vulnerabilities (CVE-2026-104935) and OpenSSH password authentication bypass
This CERT-FR weekly bulletin (CERTFR-2026-ACT-047, week 45) re-flags two updated alerts. The first covers multiple vulnerabilities in Ivanti Connect Secure (ICS), referenced by CVE-2026-104935 in the Ivanti Security Advisory and by CERT-FR advisories CERTFR-2026-AVI-1311 (14 October 2026) and CERTFR-2026-AVI-1442 (2 November 2026). The second is a vulnerability in OpenSSH: the bulletin links the OpenSSH release-10.6p2 advisory, an Alpine Linux advisory dated 5 November 2026 whose title names a password authentication bypass, and CERT-FR advisories CERTFR-2026-AVI-1468 and CERTFR-2026-AVI-1480 (both 5 November 2026). The bulletin gives no CVSS scores, no affected version ranges for Ivanti, and no statement on exploitation in the wild. It is a roundup that points to the vendor advisories for fixes and says it does not replace a risk analysis. Criticity is rated high because both products are network-facing authentication services and the bulletin itself flags the issues as significant, while no active exploitation is reported.
Entenda a falha
A vulnerabilidade
The story covers two items re-flagged in a CERT-FR weekly bulletin. The first is multiple vulnerabilities in Ivanti Connect Secure (ICS), referenced by CVE-2026-104935 in the Ivanti Security Advisory. The bulletin gives no CVSS score, no affected or fixed versions and no details on what an attacker needs or gets. The second is an OpenSSH vulnerability; the linked Alpine advisory title names a password authentication bypass, and OpenSSH release 10.6p2 is the referenced fix release. The bulletin gives no CVE for it and no further detail.
Como foi descoberta
The articles do not say how either flaw was found. The Ivanti issue was published in a vendor advisory and in CERT-FR advisories dated 14 October and 2 November 2026. The OpenSSH issue appears in the OpenSSH 10.6p2 release notes, an Alpine advisory of 5 November 2026 and two CERT-FR advisories of the same date. The bulletin reports no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:25.
Remediação
- OpenSSH: disable password authentication or, if patching is not possible, disable the sshd service. Any patch or configuration change must be followed by a restart of sshd, according to the bulletin.
- Ivanti Connect Secure: the bulletin refers to the Ivanti Security Advisory and the CERT-FR advisories for the fix and names no fixed build.
- Use the bulletin as a prioritisation aid: every vulnerability covered by a CERT-FR advisory that creates risk for the information system should get an action plan.
Linha do tempo
-
Ivanti Connect Secure multiple vulnerabilities (CVE-2026-104935) and OpenSSH password authentication bypass
ler a análise desta fonte ocultar
This CERT-FR weekly bulletin (CERTFR-2026-ACT-047, week 45) re-flags two updated alerts. The first covers multiple vulnerabilities in Ivanti Connect Secure (ICS), referenced by CVE-2026-104935 in the Ivanti Security Advisory and by CERT-FR advisories CERTFR-2026-AVI-1311 (14 October 2026) and CERTFR-2026-AVI-1442 (2 November 2026). The second is a vulnerability in OpenSSH: the bulletin links the OpenSSH release-10.6p2 advisory, an Alpine Linux advisory dated 5 November 2026 whose title names a password authentication bypass, and CERT-FR advisories CERTFR-2026-AVI-1468 and CERTFR-2026-AVI-1480 (both 5 November 2026). The bulletin gives no CVSS scores, no affected version ranges for Ivanti, and no statement on exploitation in the wild. It is a roundup that points to the vendor advisories for fixes and says it does not replace a risk analysis. Criticity is rated high because both products are network-facing authentication services and the bulletin itself flags the issues as significant, while no active exploitation is reported.
Remediation
- OpenSSH: disable password authentication or, if patching is not possible, disable the sshd service. Any patch or configuration change must be followed by a restart of sshd, according to the bulletin.
- Ivanti Connect Secure: the bulletin refers to the Ivanti Security Advisory and the CERT-FR advisories for the fix and names no fixed build.
- Use the bulletin as a prioritisation aid: every vulnerability covered by a CERT-FR advisory that creates risk for the information system should get an action plan.