CISA has issued an urgent alert over CVE-2026-104935, an authentication bypass and remote code execution vulnerability in Ivanti Connect Secure that is being actively exploited in the wild. The agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

The vulnerability affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. It allows remote, unauthenticated attackers to execute arbitrary commands, which threat actors are reportedly leveraging for credential theft and data exfiltration.

According to Dark Reading, the issue traces back to a July patch that only partially addressed the underlying flaw, leaving an opening that attackers have since capitalized on. That incomplete fix underscores a recurring challenge for Ivanti and its customers: zero-day disclosures that require multiple patch cycles before the vulnerability is fully closed.

Detection Is Difficult

CISA warns that Ivanti’s Integrity Checker Tool may fail to detect exploitation because threat actor commands run entirely in memory, leaving no persistent artifacts for the tool to flag. Organizations are instead directed to conduct network and memory forensics to determine whether they have been compromised.

Recommended Actions

CISA urges all organizations running affected Ivanti Connect Secure appliances to update immediately per Ivanti’s security advisory, and to consult the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for deployment-specific instructions. Note that version 22.8 reaches end of life on January 31, 2027.

For organizations suspecting compromise, CISA recommends:

  • Backing up the appliance configuration before remediation
  • Performing a factory reset (or rebuilding virtual/cloud instances) and upgrading to the latest version
  • Restoring configuration from the pre-remediation backup
  • Resetting passwords for all domain, administrator, and local accounts
  • Revoking and reissuing certificates, and resetting API keys and license server credentials

CISA also pointed organizations to a Volexity analysis detailing chained exploitation of Ivanti Connect Secure zero-days for additional technical context on attacker tactics.