CISA Adds Actively Exploited Ivanti Connect Secure Zero-Day to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog, citing confirmed exploitation by cyber threat actors. The vulnerability is a zero-day authentication bypass flaw in Ivanti Connect Secure, affecting appliance versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Exploitation allows remote, unauthenticated attackers to execute arbitrary commands on the affected appliance, facilitating credential theft and data exfiltration.

Ivanti disclosed the vulnerability and released a corresponding security advisory. CISA urges organizations with affected deployments to update to the latest available version without delay. Ivanti notes that version 22.8 reaches end of life on January 31, 2027, and recommends consulting the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching guidance on hardware and virtual appliance deployments.

Detection of exploitation is complicated by the nature of the attack: Ivanti's Integrity Checker Tool may not identify evidence of exploitation because threat actor commands execute in memory. Organizations suspecting compromise are advised to conduct network and memory forensics, perform a factory reset, upgrade to the latest version, reset all account passwords, and revoke and reissue stored certificates, API keys, and license server credentials.

CISA emphasizes that the information is provided "as is" for informational purposes and does not constitute endorsement of any commercial entity or product. The agency also directs organizations to review the Volexity blog post detailing chained exploitation of Ivanti Connect Secure zero-days for additional context.