CISA adds exploited Ivanti Connect Secure zero-day to KEV catalog, urges immediate patching

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has flagged an actively exploited zero-day in Ivanti Connect Secure VPN appliances and added it to the Known Exploited Vulnerabilities catalog. The flaw enables unauthenticated remote command execution used for credential theft and data exfiltration. This segment covers the affected versions, why standard detection tooling falls short, and the recovery steps CISA endorses for suspected compromise.

• CVE-2026-104935 is a zero-day authentication bypass enabling remote, unauthenticated arbitrary command execution; added to CISA's KEV Catalog on Oct. 13, 2026.
• Affected: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; version 22.8 reaches end of life Jan. 31, 2027.
• Ivanti's Integrity Checker Tool may miss exploitation because threat actor commands execute in memory; network and memory forensics required.

Executive summary

CISA issued an alert on October 13, 2026 following Ivanti's disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA described the flaw as a zero-day authentication…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.