CISA Urges Patching Newly Exploited security flaw in Ivanti Connect Secure

What happened

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935 (the public catalogue number for a specific software flaw) , affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct.

Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.

CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935) . Ivanti Connect Secure version 22.8 reaches end of life on Jan.