U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
CISA added exploited Ivanti Connect Secure CVE-2026-104935 to KEV, with a federal deadline of October 16.
CISA added Ivanti Connect Secure CVE-2026-104935, an authentication-bypass flaw scored CVSS 8.6, to the Known Exploited Vulnerabilities catalog. Versions before 25.1.3.0 let a remote unauthenticated attacker execute arbitrary commands; 22.7R2.14 and earlier are unaffected. Ivanti said exploitation has hit a limited number of customers. Federal agencies must remediate by October 16, 2026.
- CVE-2026-104935 is an authentication bypass with CVSS 8.6.
- Unauthenticated remote attackers can run arbitrary commands on affected ICS.
- Versions before 25.1.3.0 are affected; 22.7R2.14 and earlier are not.
- Ivanti confirmed limited in-the-wild exploitation; federal deadline is October 16, 2026.
Vulnerabilities mentionedAll →
- CVE-2026-1049358.626%Auth Bypass to Command Execution in Ivanti Connect Securepublished · Ivanti Connect Secure KEV PoC ×2
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-104935 |
Full article260 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected.
“Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.” reads the advisory. “Ivanti has released updates for Ivanti Connect Secure (ICS) which addresses one high severity vulnerability. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands.”
The company confirmed that the vulnerability was exploited in attacks in the wild.
“We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” continues the report.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by October 16, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)