CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. The entry affects Ivanti Connect Secure and describes an authentication bypass by spoofing that lets a remote, unauthenticated attacker execute arbitrary commands.
The vulnerability is an authentication bypass: an attacker can circumvent authentication through spoofing and then execute commands remotely without first authenticating. The supplied data does not provide a CVSS score or severity rating. Patch status is unknown, and no patch or advisory URL is listed in the data. Ivanti’s security advisory is available at https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935.
CISA’s KEV listing means the vulnerability is known to be actively exploited. The supplied data does not confirm whether attackers have used it in ransomware campaigns; ransomware use is listed as unknown. CISA’s remediation deadline for this entry is 16 October 2026.
CISA requires affected Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with Ivanti’s instructions, following applicable BOD 26-04 guidance and CISA’s Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must assess each asset’s internet exposure and ensure compliance with BOD 26-04 patching guidance. All organisations should review their exposure and follow Ivanti’s instructions.
For full details, consult the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-104935) and the [CISA KEV catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).