CISA Urges Immediate Patching of Exploited Ivanti Connect Secure Zero-Day
Summary
CISA says attackers are exploiting an authentication bypass in Ivanti Connect Secure for credential theft and data exfiltration, and urges organizations to patch affected appliances and investigate possible compromise.
Key points
- CVE-2026-104935 is an authentication bypass that allows remote, unauthenticated command execution.
- Affected versions include Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
- CISA says attackers are exploiting the vulnerability for credential theft and data exfiltration; it added the CVE to its KEV Catalog on Oct. 13, 2026.
- CISA urges organizations to update affected appliances to the latest version and follow Ivanti’s patching guidance.
- Network and memory forensics may be needed to identify compromise; Ivanti’s Integrity Checker Tool may miss evidence because commands execute in memory.
- For suspected compromise, CISA recommends rebuilding or resetting affected appliances, restoring configuration, resetting passwords, and revoking and reissuing stored certificates and keys.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote command execution
- Affected Versions
- Ivanti Connect Secure 25.1.1.1 and prior
- Ivanti Connect Secure 25.1.2.2 and prior
- Ivanti Connect Secure 22.8R2.4 and prior
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1003 · OS Credential DumpingThe article reports credential theft as an objective of the exploitation.T1041 · Exfiltration Over C2 ChannelThe article reports data exfiltration as an objective of the exploitation.T1059 · Command and Scripting InterpreterThreat actors exploit the authentication bypass to execute arbitrary commands remotely.