cyber threat actors

CISA Adds Actively Exploited Ivanti Connect Secure Zero-Day to KEV Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that threat actors are exploiting a zero-day authentication bypass vulnerability in Ivanti Connect Secure. The flaw affects versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, enabling remote, unauthenticated attackers to execute arbitrary commands for credential theft and data exfiltration. CISA added the vulnerability on October 13, 2026. Ivanti released a security advisory addressing the flaw, and organizations are urged to patch immediately. Version 22.8 appliances approach end-of-life on January 31, 2027.