CVE-2026-104935 — an authentication‑bypass vulnerability with a CVSS score of 8.6 that is under active exploitation — has been added to CISA’s Known Exploited Vulnerabilities catalog, and Federal Civilian Executive Branch agencies are required to apply fixes by October 16, 2026.
CVE-2026-104935 and the Ivanti Connect Secure versions affected
The flaw, tracked as CVE-2026-104935, targets Ivanti Connect Secure (ICS) appliances and is described by federal authorities as an authentication bypass that “could enable remote, unauthenticated actors to execute arbitrary commands.” CISA’s advisory identifies the specific affected ISC releases as:
- 25.1.1.1 and prior
- 25.1.2.2 and prior
- 22.8R2.4 and prior
CISA warns threat actors are exploiting the flaw to steal credentials and data, and it recommends that organizations update affected deployments to the newest Ivanti Connect Secure version. Ivanti’s Connect Secure Upgrade and Migration Compatibility Guide is cited by CISA as the source for patching guidance.
CISA action, the KEV listing, and the October 16 compliance date
CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog. Because of that listing, Federal Civilian Executive Branch (FCEB) agencies are mandated to apply the fixes by October 16, 2026. CISA also urges organizations that are unsure whether they have been compromised to conduct memory and network forensics to look for evidence of exploitation.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleObserved exploitation, credential theft, and in‑memory execution
Security practitioners cited in the advisory describe a dangerous exploitation chain. Shane Barney, Chief Information Security Officer at Keeper Security, warned that attackers can combine an authentication bypass with remote code execution and privilege escalation to obtain root control of an appliance. In his words:
“Threat actors like UTA0576 pair authentication bypass and remote code execution with privilege escalation to go from unauthenticated access to root control of the appliance. With root access on the appliance, the device stops protecting the network and becomes an attacker-controlled pivot point. In the one incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. Valid credentials are harder to spot than malware, which is part of why this chain is so hard to contain.”
CISA cautions defenders that Ivanti’s Integrity Checker Tool may not identify signs of CVE-2026-104935 exploitation because the attacker’s commands execute in memory — a detail that complicates detection and reinforces the agency’s recommendation for memory and network forensics.
Expert mitigation advice from Shane Barney, Robert Costello, and Tim Mackey
Several named experts appended practical guidance to CISA’s technical warning. Shane Barney advised organizations to remove standing administrative privileges, enforce least-privilege access, enable phishing‑resistant multi‑factor authentication for every privileged login, rotate domain, admin and local passwords as CISA recommends, and “vault and automatically rotate privileged credentials so a stolen password goes stale quickly.”
Robert Costello, Chief Digital and Information Officer at Merlin Group, framed the vulnerability as an example of the risks edge devices pose: they “sit at critical points in our networks, providing important protections, but they may also have significant access, while visibility can be limited.” Costello also called attention to attackers’ use of AI to accelerate vulnerability discovery, automate exploit development, and scale reconnaissance, and he urged organizations to “know what’s exposed, prioritize vulnerabilities being actively exploited, reduce unnecessary access, and improve monitoring.” He recommended applying CISA guidance on securing edge devices and BOD 26‑04 beyond federal agencies to state and local governments, critical infrastructure operators, and private sector organizations.
Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck, urged defenders and software producers to look beyond single‑CVE triage and to focus on how vulnerability chains can operate within software stacks — an observation that mirrors the exploitation patterns publicized in the advisory.
What this means for technologists, procurement leaders, and federal agencies
- Technologists and security teams: Prioritize patching for the listed ISC versions, run memory and network forensics if compromise is suspected, and assume in‑memory command execution may evade file‑integrity checks.
- Procurement and operations leaders: Treat edge appliances as high‑risk assets with significant access; follow Ivanti’s upgrade guidance and consider architecture changes that reduce standing privileges and unnecessary exposure.
- Federal agencies bound by the KEV requirement: Meet the October 16, 2026 remediation deadline and apply the CISA-prescribed mitigations while documenting detection and response actions.
The advisory links a short, present danger — active exploitation and credential theft — to a longer, systemic issue: appliances with broad access can be turned into invisible pivot points when attackers chain vulnerabilities and execute in memory. Organizations that rely on Ivanti Connect Secure now face a straightforward technical task (apply the patch per Ivanti’s guidance) and a harder operational one (reduce blast radius and improve detection for in‑memory attacks). Which of those two will take longer is a question the calendar and the October 16 compliance date will begin to answer.
Original advisory: https://www.securitymagazine.com/articles/102655-newly-exploited-vulnerability-in-ivanti-connect-secure
