CISA Adds an Ivanti Connect Secure Authentication-Bypass Flaw to Its Known Exploited Vulnerabilities Catalog

What happened?

On 13 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog. The catalog entry names the product as Ivanti Connect Secure, a VPN appliance widely used for remote access, and describes the flaw as an authentication bypass that lets a remote, unauthenticated attacker run arbitrary commands.

Inclusion in the KEV catalog is CISA’s own confirmation that a vulnerability is being actively exploited, not just a theoretical risk. CISA’s catalog entry sets a required action date of 16 October 2026 for the vulnerability, and requires forensic triage under Binding Operational Directive 26-04, which asks agencies to look for signs of compromise rather than simply patch and move on. CISA classes the flaw as authentication bypass by spoofing (CWE-290).

Who does this bind, and who should still care?

CISA’s KEV deadlines are legally binding only on US federal civilian executive branch agencies. Everyone else runs Connect Secure under their own patching policy. But a KEV listing is still one of the clearest public signals available that a specific, named flaw is being used in real attacks right now, which is why security teams outside the federal government routinely treat it as a trigger for urgent action.

Why does it matter?

Authentication-bypass flaws in internet-facing VPN appliances are a recurring target for ransomware crews and other intrusion actors, because a single foothold on the appliance can give an attacker a path into the internal network behind it. The requirement for forensic triage, rather than just applying the fix, reflects a pattern CISA has flagged before with edge-device compromises: a device can be fully patched and still be hiding an earlier compromise.

What should you do?

Anyone running Ivanti Connect Secure should check Ivanti’s own advisory for the exact affected and fixed versions, apply the update, and look for signs of prior compromise rather than assuming a clean patch closes the matter. Treat any appliance that was internet-facing and unpatched while the flaw was being exploited as a candidate for forensic review, not just a routine update.