CISA adds actively exploited Ivanti Connect Secure zero-day to the KEV catalog

CVE-2026-104935 (CVSS 8.6) is an authentication bypass in Ivanti Connect Secure that lets a remote unauthenticated attacker execute arbitrary commands. CISA says actors are using it for credential theft and data exfiltration, added it to the Known Exploited Vulnerabilities catalog on October 13, and set an October 16 remediation deadline for federal agencies. Volexity reports the actor UTA0576 chaining it with two other flaws to reach root and target LAPS passwords and BitLocker keys.

Sources: BleepingComputer; The Hacker News