CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
Attackers are exploiting an Ivanti Connect Secure zero-day for unauthenticated commands, credential theft, and data exfiltration.
CISA says threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure, to run arbitrary commands without authentication and to steal credentials and exfiltrate data. Affected releases are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The flaw was added to the KEV Catalog on Oct. 13, 2026. CISA warns Ivanti's Integrity Checker Tool may miss exploitation because commands run in memory, and recommends backup, factory reset or virtual rebuild, upgrade, and rotation of passwords, certificates, API keys, and licenses. Version 22.8 reaches end of life on Jan. 31, 2027.
- CVE-2026-104935 is an exploited zero-day authentication bypass.
- It allows remote, unauthenticated arbitrary command execution.
- Affected branches include 25.1.1.1, 25.1.2.2, and 22.8R2.4 and earlier.
- Ivanti's Integrity Checker Tool may miss in-memory exploitation.
- CISA advises factory reset or rebuild, then password and certificate rotation.
Vulnerabilities mentionedAll →
- CVE-2026-1049358.626%Auth Bypass to Command Execution in Ivanti Connect Securepublished · Ivanti Connect Secure KEV PoC ×2
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-104935 |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 25.1.1.1 | CVE-2026-104935 , affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA |
| ipv4 | 25.1.2.2 | ffecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber t |
Full article382 words · extracted from cisa.gov · click to collapse
CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.
CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935). Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.
Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. Note: Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.
If your organization suspects a compromise, CISA recommends implementing the following actions from Ivanti Connect Secure Recovery Procedures:
- Create a backup of the appliance configuration. Review Ivanti’s How to Backup & Restore the Binary Configuration Using Archiving Server for more information.
- Conduct a factory reset and upgrade the appliance to the latest version.
- For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
- Restore the appliance configuration from the backup created in step 1.
- Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
CISA urges organizations to review the Ivanti security advisory and guide noted above and apply necessary updates. CISA also recommends reviewing the Volexity blog, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.