Our automated tracking framework flagged that CISA added CVE-2026-104935 (Ivanti Connect Secure) to the Known Exploited Vulnerabilities (KEV) catalog on October 16, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-104935 by October 16, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-104935 |
| Vendor / product | Ivanti Connect Secure |
| Vulnerability | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
| CVSS base score | 8.6 |
| Added to KEV | October 13, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 16, 2026 |
| Known ransomware use | No |
How This Compares to Ivanti’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| Ivanti in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 36 |
| Median lag (public → KEV listing) | 17 days |
| 0-day rate (exploited at or before disclosure) | 28% |
| Entries tied to known ransomware campaigns | 12 |
For perspective, the median across all 1746 tracked KEV entries is 242 days — Ivanti’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Ivanti KEV Additions
The most recent Ivanti vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-10520 | Sentry | June 11, 2026 | 2 | No |
| CVE-2026-6973 | Endpoint Manager Mobile (EPMM) | May 7, 2026 | 0 | No |
| CVE-2026-1340 | Endpoint Manager Mobile (EPMM) | April 8, 2026 | 69 | No |
| CVE-2026-1603 | Endpoint Manager (EPM) | March 9, 2026 | 27 | No |
| CVE-2026-1281 | Endpoint Manager Mobile (EPMM) | January 29, 2026 | 0 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has urgently added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, flagging an authentication bypass vulnerability in Ivanti Connect Secure. This flaw, with a CVSS base score of 8.6, allows attackers to circumvent authentication mechanisms, potentially granting unauthorized access to sensitive systems. CISA added it to the KEV catalog on 2026-10-13, with a federal patch deadline of 2026-10-16. This means organizations using Ivanti Connect Secure should prioritize patching immediately.
The zero-day lag between public disclosure and KEV listing indicates exploitation began concurrently with, or even before, public knowledge, leaving no detection window for proactive defense. Organizations are highly exposed and must patch before the 2026-10-16 deadline to mitigate significant risk. While ransomware use hasn’t been confirmed for this specific CVE, the severity makes it an attractive target for various threat actors.
If you cannot meet the 2026-10-16 deadline, implement compensating controls. Isolate Ivanti Connect Secure instances from critical internal networks, apply strict network segmentation, and enhance monitoring for unusual activity originating from or targeting these devices. Reviewing access logs and enforcing multi-factor authentication where applicable can also help detect and deter unauthorized access attempts. However, these are temporary measures; prompt patching remains the only effective long-term solution.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
