CISA Adds Ivanti Connect Secure Authentication Bypass to KEV Catalog Amid Active Exploitation

What Happened

CISA has added CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities (KEV) catalog as of October 13, 2026. According to CISA, the flaw allows a remote, unauthenticated attacker to execute arbitrary commands against affected Connect Secure appliances. CVSS scoring has not yet been published, and whether any known ransomware operators are leveraging this flaw is currently listed as unknown.

Why It Matters

Connect Secure is Ivanti's SSL VPN/remote access gateway, typically deployed at the network perimeter to broker access into internal environments for remote employees and third parties. An unauthenticated, spoofing-based bypass that leads to command execution is a high-severity combination: no credentials are required, and successful exploitation can hand an attacker a foothold directly inside the network boundary the device is meant to protect. Ivanti edge appliances have a well-established history of being targeted by both opportunistic and state-nexus actors shortly after disclosure, so KEV inclusion signals that exploitation is already occurring in the wild, not merely theoretical.

What Defenders Should Do Now

• Identify all internet-facing and internal Ivanti Connect Secure instances and confirm patch/version status against Ivanti's advisory as it becomes available.
• Review Connect Secure authentication logs for anomalies consistent with spoofing — successful logins or session establishment without a corresponding, expected credential-validation event.
• Hunt for post-exploitation indicators on and behind the appliance: unexpected process execution from VPN gateway service accounts, new or modified web shells on the appliance filesystem, and outbound connections from the device to unfamiliar infrastructure.
• Review network flow logs for lateral movement originating from the Connect Secure appliance's management or internal-facing interfaces.
• If patching isn't immediately available, consider Ivanti's standard interim mitigations (e.g., restricting management interface exposure) and heightened monitoring until a fix is confirmed.

Developing Intel

This is a fresh KEV entry and details are still emerging — CVSS scoring, a full technical writeup, and confirmed threat-actor attribution are not yet available. We will track this item as more information is published. For the authoritative record, see the NVD entry for CVE-2026-104935.