Ivanti Connect Secure zero-day CVE-2026-104935 exploited for unauthenticated RCE, credential theft and data exfiltration; added to CISA KEV
CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. …