Science & Tech · Cybersecurity · 1 hr ago
CISA adds exploited Ivanti Connect Secure flaw to its vulnerability list
CISA has listed an actively exploited flaw in Ivanti Connect Secure, a security product used to protect networks.
The flaw, tracked as CVE-2026-104935, is an authentication bypass: a remote attacker can run commands without logging in on affected versions.
Ivanti says attacks are already affecting a limited number of customers, and the flaw has a high severity rating.
Ivanti has released updates to address the vulnerability, and administrators are urged to install them promptly.
CISA’s catalog identifies security weaknesses known to be exploited, and federal agencies must fix this flaw by October 16, 2026.
Private organizations are also advised to check their systems and address the vulnerability.
CISA added the Ivanti Connect Secure vulnerability CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
The authentication-bypass flaw can let remote, unauthenticated attackers execute arbitrary commands on affected systems.
Ivanti and security researchers reported that attackers were exploiting the flaw in the wild.
CISA urged organizations to update affected systems and check for signs of compromise.
CISA ordered U.S. federal civilian agencies to address the vulnerability by October 16, 2026.
- Who
- CISA, Ivanti and security researchers reported the vulnerability and its exploitation. Attackers are targeting affected Ivanti Connect Secure systems.
- What
- CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog. The flaw allows remote, unauthenticated command execution.
- When
- CISA added the flaw on October 13, 2026. Researchers reported exploitation dating to at least October 1.
- Where
- Affected Ivanti Connect Secure appliances and deployments. CISA's federal deadline applies to Federal Civilian Executive Branch agencies.
- Why
- The flaw is being actively exploited and can enable arbitrary command execution. CISA urged patching to protect systems and identify possible compromises.
This story does not have two clearly opposing sides.
Researchers said they had found evidence that attackers were exploiting CVE-2026-104935 by this date.
Volexity said an unknown threat actor had been chaining the flaw with two others in attacks since at least this date.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Federal Civilian Executive Branch agencies were due to secure their networks against the flaw.
- Vulnerability
- CVE-2026-104935
- Severity
- CVSS score of 8.6
- Product
- Ivanti Connect Secure
- Federal deadline
- October 16, 2026
- Observed exploitation
- At least October 1, 2026
3 sources
What people are saying
CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version.
act immediately
We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.
Posts on X
🚨 Our Ivanti Connect Secure decoys caught pre-disclosure exploitation we assess as CVE-2026-104935. Activity was recorded on Oct 1st, twelve days before Ivanti’s advisory, on both our public honeypots and customer instances. The exploit ran an unauthenticated bypass to plant an