CVE-2026-104935 — a high-severity authentication bypass in Ivanti Connect Secure — has been exploited in zero-day attacks since at least October 1st, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned, and it can allow remote, unauthenticated execution of arbitrary commands.
What CISA ordered and advised
On Tuesday, CISA added CVE-2026-104935 to its list of actively exploited security flaws and ordered Federal Civilian Executive Branch agencies to secure their networks by Friday under BOD 26-04. The agency also issued a broader advisory urging all security teams and network defenders to patch immediately and hunt for signs of compromise.
CISA warned: "CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [...] CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version."
How the flaw works and how attackers have used it
The vulnerability, tracked as CVE-2026-104935, is an authentication bypass in Ivanti Connect Secure (ICS) that permits remote threat actors with no privileges to execute arbitrary commands. CISA described the attacks as low-complexity and not requiring user interaction.
Cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this issue with two other flaws in attacks since at least October 3rd. As Volexity put it: "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935."
Volexity further identified "a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys." CISA advised that organizations seeking to determine whether they were compromised "will need to conduct network and memory forensics to identify evidence of exploitation."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIvanti's patches and mitigation guidance
Ivanti released updated Connect Secure versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address the flaw and warned customers to "act immediately" because of "limited exploitation in the wild." The company also cautioned that Ivanti's Integrity Checker Tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."
CISA set out specific remediation and recovery steps for compromised Ivanti ICS appliances: create a backup of the appliance configuration; perform a factory reset and upgrade the appliance to the latest version (or rebuild virtual/cloud instances and upgrade); restore the configuration from the backup; and reset passwords for all accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.
Exposure on the public internet and historical context
Internet threat watchdog Shadowserver now tracks over 5,600 Internet-exposed hosts with Ivanti Connect Secure fingerprints, though the available reporting does not indicate how many of those hosts are patched, compromised, or intentionally deployed as honeypots.
Ivanti Connect Secure has been the target of multiple zero-days in recent years. The vendor addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, followed two weeks later by a server-side request forgery (CVE-2024-21893). More recently, Ivanti patched RCE flaws CVE-2025-0282 in January 2025 and CVE-2025-22457, which the source describes as exploited by "China-linked cyber spies" since at least mid-March 2025. Since November 2021, CISA has added 36 Ivanti vulnerabilities to its list of actively exploited issues, 12 of which have also been abused in ransomware attacks.
What this means for federal agencies, security teams, and Ivanti customers
- Federal agencies: BOD 26-04 requires FCEB agencies to secure networks by the specified deadline; agencies must follow CISA's playbook for backup, factory reset or rebuild, upgrade, and credential and certificate rotation.
- Security teams and network defenders: CISA urges immediate updates and forensic hunts. Because exploitation executes commands in memory, teams should prioritize network and memory forensics and not rely solely on Ivanti's Integrity Checker Tool.
- Ivanti customers and procurement leaders: Organizations running affected ICS versions should upgrade to the patched releases Ivanti published (22.8R2.5, 25.1.3.0, 25.1.3.1, 25.1.1.2) and be prepared to reset accounts and reissue certificates if compromise is suspected.
For defenders the clock is short and the forensic challenge is clear: a low-complexity, unauthenticated flaw that leaves memory-only traces complicates detection and recovery. Ivanti has issued fixes; CISA has ordered federal action and urged all organizations to act. The immediate task is straightforward in description but potentially costly in execution — patch, hunt, and, where necessary, rebuild.
