What We Know
CISA has warned security teams to patch a newly disclosed Ivanti Connect Secure vulnerability, identified as CVE-2026-104935, after learning that it was being exploited in the wild.1Backed by 1 sourcescisa.gov
SecurityWeek reports that exploitation involved a zero-day chain capable of obtaining root access to a fully patched VPN appliance, while another account says the activity ran entirely in memory and evaded the vendor’s integrity-checking tool.2Backed by 2 sourcessecurityweek.comblog.malwlab.se
CVE-2026-104935 is characterized as a high-severity authentication bypass affecting Ivanti Connect Secure and appears in CISA’s exploited-vulnerability context.2Context supported by 2 independent sourceslabs.beazley.securitysecurityarsenal.com The excerpt repeats the warning that administrators should immediately patch an Ivanti flaw exploited as a zero-day, but it does not provide the vulnerability identifier or further technical detail.1Context from one sourceBleepingComputer
Source Comparison
Aligned reportingCorroborates
- cisa.gov↗CISA’s alert identifies CVE-2026-104935 as newly exploited and urges patching for Ivanti Connect Secure.
- securityweek.com↗The report describes a zero-day chain that gave attackers root access to a fully patched VPN appliance, supporting the briefing’s account of the exploitation’s impact.
- blog.malwlab.se↗This account adds the stealth details that the zero-day chain affected a fully patched appliance, ran entirely in memory, and evaded the vendor’s integrity-checking tool.
Adds context
- BleepingComputer↗The excerpt repeats the warning that administrators should immediately patch an Ivanti flaw exploited as a zero-day, but it does not provide the vulnerability identifier or further technical detail.
- labs.beazley.security↗The advisory characterizes CVE-2026-104935 as a high-severity authentication-bypass vulnerability under active exploitation, reinforcing its security significance.
- securityarsenal.com↗The guide independently labels CVE-2026-104935 an Ivanti Connect Secure authentication bypass in the CISA KEV context, but the excerpt does not provide the briefing’s explanatory detail.