Our takeCISA added CVE-2026-104935 in Ivanti Connect Secure to its KEV catalog: confirmed exploited in the wild for unauthenticated RCE. Patch now if you run it.Security Resilience desk
Sources (10)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- bleeping · bleeping
- rapid7 · rapid7
- securityweek · securityweek
- cccs · cccs
- cyberscoop · cyberscoop
- securityweek · securityweek
- therecord · therecord
- darkreading · darkreading
What this means for you — Security leader:CISA added CVE-2026-104935 in Ivanti Connect Secure to the KEV catalog: it is confirmed exploited in the wild and allows unauthenticated remote command execution. Apply the vendor patch or mitigations immediately if you run any affected version.
What this means for you — Lean IT orgs:Ivanti Connect Secure has a confirmed exploited vulnerability that lets attackers run commands without logging in. Check with your IT provider or MSP today about whether you use it and if the fix is applied.
What this means for you — MSP:CVE-2026-104935 is confirmed exploited in Ivanti Connect Secure (versions 25.1.1.1 and prior, 25.2.2 and prior, 22.8R2.4 and prior). Review all client instances and apply Ivanti's patch or mitigations now.
What this means for you — Researcher:CISA added CVE-2026-104935 to the KEV catalog after confirming active exploitation in Ivanti Connect Secure. It is an authentication bypass by spoofing that leads to unauthenticated remote command execution.