CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials

CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13, 2026, after attackers used an Ivanti Connect Secure zero-day for remote authentication bypass and command execution. Volexity says unknown actor UTA0576 began exploitation on October 3 against version 22.8R2.4, chaining an auth bypass, file-upload code execution, and a separate privilege-escalation flaw to gain root. Attackers collected stored domain credentials, queried Active Directory, sought local administrator passwords and BitLocker recovery keys, and conducted password spraying and network discovery. Ivanti fixed the bypass and code-execution issue on October 13; the privilege-escalation fix was still in development. CISA says patching alone is insufficient and recommends factory reset or rebuild plus rotation of passwords, certificates, API keys, and license credentials.