CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA urges patching Ivanti Connect Secure after zero-day vulnerability exploitation.
Run Ivanti?
Get an email when a reviewed story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
CISA has identified a critical zero-day vulnerability, CVE-2026-104935, in Ivanti Connect Secure that is being actively exploited by threat actors for credential theft and data exfiltration. The vulnerability allows for remote, unauthenticated command execution. CISA has added it to its Known Exploited Vulnerabilities catalog and urges immediate patching and potential forensic investigation for compromised systems.
The lesson from this incident
Full lessonA critical zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited, allowing unauthenticated remote command execution — one of the most severe risk profiles possible for an internet-facing appliance. Because no authentication is required, threat actors can compromise systems at scale before defenders even become aware of the exposure. The fact that CISA added this to its Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation, making delayed patching an unacceptable risk. Organizations relying on Ivanti Connect Secure for VPN or remote access are particularly exposed, as compromise of these systems can serve as a foothold into the broader enterprise network.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
- cve — CVE-2026-104935