THE U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-104935, carries a CVSS of 8.6 and is described as an authentication bypass caused by spoofing in ICS versions prior to 25.1.3[.]0. In practical terms, a remote, unauthenticated attacker could exploit the vulnerability to execute arbitrary commands on affected systems. Ivanti notes that ICS versions 22.7R2.14 and earlier are not impacted, and updates addressing the issue have been issued for vulnerable versions.
Ivanti confirmed exploitation in the wild affecting a limited number of customers at the time of disclosure. Under Binding Operational Directive 22-01, U.S. federal agencies are required to remediate identified KEV vulnerabilities by specific deadlines to reduce the risk of exploitation. The advisory also urges private organisations to review the KEV catalog and apply the relevant patches to mitigate potential attacks.
CISA has set a due date of 16 October 2026 for fixes at federal agencies, underscoring the urgency for institutions to validate ICS deployments and deploy the available updates to block unauthenticated remote command execution.