CISA Flags Ivanti Connect Secure Vulnerability in KEV List Amid Rising Exploit Activity

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a newly disclosed flaw in Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog, signaling that the weakness is already being leveraged by threat actors. The vulnerability, identified as CVE-2026-104935, pertains to the FortiMail component of Ivanti's remote access solution.

CISA’s KEV catalog is a curated repository of security flaws that have been observed in the wild, and inclusion signals a heightened risk level for organizations that run the affected software. By publishing the entry, the agency aims to prompt federal and private sector entities to prioritize remediation, as the catalog is frequently referenced in compliance frameworks such as the Federal Risk and Authorization Management Program (FedRAMP) and the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC).

Ivanti Connect Secure is widely deployed for secure remote access, VPN, and email gateway functions, particularly in enterprises that require granular authentication controls. The FortiMail module provides integrated email security, and the newly reported flaw could allow unauthenticated attackers to bypass security checks, potentially leading to unauthorized data access or the execution of arbitrary code on vulnerable systems.

Security researchers first reported the issue to Ivanti earlier this month, and the vendor released an advisory recommending immediate patching. While the specific technical details of the exploit have not been fully disclosed, the fact that CISA has placed the flaw on the KEV list suggests that malicious actors are already crafting or deploying exploit code in the wild. Organizations that have not yet applied the vendor’s remediation patches are urged to do so without delay.

The addition comes at a time when the cybersecurity community is observing a surge in exploitation of unpatched remote access tools, a trend amplified by the ongoing shift to hybrid work environments. Analysts note that attackers frequently target VPN and email gateway solutions because they serve as gateways into corporate networks, making rapid patch management a critical defensive measure.

Looking ahead, CISA will continue to monitor the situation and may issue further guidance or directives if evidence of widespread compromise emerges. Stakeholders are also encouraged to leverage threat intelligence feeds and to conduct thorough vulnerability scans to confirm that the Ivanti Connect Secure patch has been applied across all endpoints. The proactive inclusion of the flaw in the KEV catalog underscores the agency’s commitment to highlighting actionable threats and helping organizations mitigate risk before attackers can capitalize on known weaknesses.