The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to update Ivanti Connect Secure appliances immediately after confirming the exploitation of an authentication bypass vulnerability in zero-day attacks since at least October 1.
The vulnerability, tracked as CVE-2026-104935, is rated high severity and allows remote, unauthenticated attackers without privileges to execute arbitrary commands on targeted systems. The attacks require no user interaction, increasing the risk to devices exposed to the internet.
Ivanti Updates and Observed Exploitation
On Tuesday, Ivanti released versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 to address the flaw and urged customers to act immediately, noting that limited exploitation was occurring in the wild.
Volexity said that an unidentified threat actor it tracks as UTA0576 began, since at least October 3, combining this vulnerability with two others to execute an attack chain involving authentication bypass, remote code execution, and privilege escalation, ultimately enabling unauthenticated command execution with root privileges.
According to Volexity, post-compromise activity targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys. Defused also confirmed finding indicators of in-the-wild exploitation of the vulnerability since October 1.
Why Does This Matter?
Shadowserver is tracking more than 5,600 internet-exposed hosts bearing Ivanti Connect Secure fingerprints, but the figure does not indicate how many are secured or represent honeypot environments. Therefore, installing the update alone is not enough to prove that no compromise occurred, especially because attackers’ commands may be executed in memory.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and required federal civilian executive agencies to secure their networks by Friday under Binding Operational Directive BOD 26-04. It also issued a separate warning to all security teams and network administrators to update systems and check for indicators of compromise.
What Should Be Done When a Compromise Is Suspected?
CISA warns against relying solely on Ivanti’s Integrity Checker Tool because it may not detect traces of CVE-2026-104935 exploitation when commands are executed in memory. The agency recommends conducting forensic analysis of the network and memory, then following these steps when a compromise is confirmed:
- Create a backup of the device configuration.
- Perform a factory reset and install the latest version; cloud and virtual systems should instead be rebuilt and updated.
- Restore the configuration from the backup.
- Change the passwords for all accounts, including domain, administrator, and local accounts.
- Revoke and reissue stored certificates, along with resetting API keys and license server credentials.
This incident is part of a series of Ivanti Connect Secure vulnerabilities exploited in the field in recent years. Since November 2021, CISA has added 36 Ivanti-related vulnerabilities to its Known Exploited Vulnerabilities catalog, 12 of which were also used in ransomware attacks.