cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

CISA Urges Immediate Patching of Ivanti Connect Secure Zero-Day Exploited in Attacks

· Original article ↗

Summary

CISA urged immediate patching of Ivanti Connect Secure flaw CVE-2026-104935, exploited since at least October 1. Ivanti released fixes; defenders should investigate for compromise and follow CISA’s recovery steps.

Key points

  • CVE-2026-104935 is a high-severity authentication bypass that enables unauthenticated remote command execution on affected Ivanti Connect Secure systems.
  • Ivanti released fixed versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2, and warned customers to act immediately.
  • CISA added the flaw to its actively exploited vulnerabilities list and directed federal agencies to remediate by Friday; it also urged all affected organizations to patch and check for compromise.
  • Volexity reported attacks by an unknown actor it tracks as UTA0576, including efforts to obtain Active Directory credentials, LAPS passwords, and BitLocker recovery keys.
  • CISA recommends network and memory forensics because the Ivanti Integrity Checker Tool may miss exploitation evidence when commands run in memory.
  • For compromised appliances, CISA advises backing up configuration, factory-resetting or rebuilding and upgrading, restoring the configuration, and rotating passwords, certificates, API keys, and license-server credentials.

Article Details

Vulnerability Types
  • Authentication bypass
  • Remote code execution
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • For compromised appliances, back up the configuration, factory-reset and upgrade the appliance (or rebuild and upgrade cloud or virtual instances), then restore the backup. Reset account passwords and reissue stored certificates; reset stored API keys and license-server credentials.

CVE

CVE-2026-104935Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't

Threat Actors

UTA0576Volexity's name for an unknown threat actor it reported chaining this vulnerability with two other flaws in attacks.

Vendors

IvantiCISA warns admins to immediately fix Ivanti flaw exploited as zero-day

Products

Ivanti Connect SecureCybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.

Tools

Integrity Checker Tool[..] Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."

Related Articles