Our takeCISA added CVE-2026-104935 in Ivanti Connect Secure to its KEV catalog: confirmed exploited in the wild for unauthenticated RCE. Patch now if you run it.Security Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- hackernews · hackernews
What this means for you — Security leader:CISA added CVE-2026-104935 (authentication bypass leading to unauthenticated RCE) in Ivanti Connect Secure to its KEV catalog: confirmed exploited in the wild. Patch to latest version immediately if you run any affected build (≤25.1.1.1, ≤25.1.2.2, or ≤22.8R2.4).
What this means for you — Lean IT orgs:Update your Ivanti Connect Secure appliance to the newest version right away if you run it. Most small teams without this product can ignore this one.
What this means for you — MSP:Check every client Ivanti Connect Secure deployment and update to the latest version immediately; this CVE-2026-104935 authentication bypass is confirmed exploited in the wild per CISA KEV.
What this means for you — Researcher:CISA added CVE-2026-104935 to its KEV catalog: authentication bypass with unauthenticated remote command execution in Ivanti Connect Secure ≤25.1.1.1, ≤25.1.2.2, and ≤22.8R2.4, confirmed exploited in the wild.