CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials

CISA urged administrators to patch Ivanti Connect Secure appliances after attackers exploited CVE-2026-104935, a zero-day flaw that allows remote authentication bypass and command execution, enabling credential theft and data exfiltration.

CISA issued its warning and added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026. The warning covers Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Organizations should follow the vendor’s security advisory to select the right update for their deployment.

CISA also directed administrators to Ivanti’s migration guide because upgrade requirements differ between hardware, cloud, and virtual appliances.

According to Volexity’s investigation, an unknown threat actor tracked as UTA0576 began exploiting the weaknesses on October 3. Researchers investigated suspicious activity on October 5 and traced it to a Connect Secure appliance running version 22.8R2.4, which was fully patched at the time. The attack combined an authentication bypass, a file upload weakness that enabled code execution, and a separate privilege escalation flaw.

Together, these weaknesses gave attackers root access, the highest level of control on the appliance. Ivanti tracks the authentication bypass and remote code execution components under CVE-2026-104935.

Attackers used the compromised appliance to collect stored domain credentials, query Active Directory, and search for local administrator passwords and BitLocker recovery keys.

Researchers also observed password spraying, network discovery, and attempts to recover credentials from captured traffic. CybersecurityNews previously covered the Ivanti zero-day used to steal Active Directory data.

CISA warned that Ivanti’s Integrity Checker Tool may miss evidence of this attack because malicious commands execute in memory. Volexity found that attackers changed library code in memory, restored configuration changes, and removed selected log entries to hide their activity.

The researchers did not identify a web shell or backdoor used to maintain command access. Instead, the attacker repeatedly ran the exploit chain and received command results through HTTPS responses. This makes network and memory analysis important when checking whether an exposed appliance was breached.

CISA Urges Ivanti 0-Day Patch

Volexity reported that Ivanti released fixes for the authentication bypass and code execution flaw on October 13. A fix for the separate privilege escalation weakness remained under development when the research was published. Administrators should not delay the available update while waiting for that additional fix.

The CISA alert recommends backing up the appliance configuration before recovery. For suspected compromise, organizations should perform a factory reset and install the latest version. Cloud and virtual deployments should be rebuilt and upgraded before administrators restore the saved configuration.

Recovery must also address stolen secrets. CISA recommends resetting domain, administrator, and local account passwords, revoking and reissuing stored certificates, and resetting stored API keys and license server credentials. Installing a patch alone does not replace these recovery steps.

Administrators can review CybersecurityNews’ earlier coverage of the affected and fixed Ivanti releases alongside vendor guidance. Organizations using the 22.8 branch should also plan migration before its January 31, 2027 end-of-life date.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.