The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** is urging security teams to immediately patch a critical **Ivanti Connect Secure (ICS)** flaw, **CVE-2026-104935**, which has been actively exploited in zero-day attacks since at least October 1st. ### High-Severity Flaw Allows Remote Code Execution **CVE-2026-104935** is a high-severity authentication bypass vulnerability. It allows remote, unprivileged threat actors to execute arbitrary commands on targeted **ICS** systems with low complexity and no user interaction. **Ivanti** released **ICS** versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this flaw, advising customers to "act immediately" due to "limited exploitation in the wild." ### Chained Exploitation for Credential Theft While **Ivanti** has not disclosed further details on the ongoing attacks, cybersecurity firm **Volexity** reported that an unknown threat actor, which they track as **UTA0576**, has been chaining **CVE-2026-104935** with two other vulnerabilities since at least October 3rd. "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under **CVE-2026-104935**," **Volexity** stated. **Volexity** further noted that the threat actor's post-exploitation activities included targeting **Active Directory** credentials and secrets, such as **Local Administrator Password Solution (LAPS)** passwords and **BitLocker** recovery keys. Threat intelligence firm **Defused** corroborated early exploitation, finding evidence of attackers abusing **CVE-2026-104935** in the wild on October 1st. Internet threat watchdog **Shadowserver** currently tracks over 5,600 Internet-exposed hosts with **ICS** fingerprints, though it's unclear how many are secured or are honeypots.  *Internet-exposed ICS hosts (Shadowserver)* ### CISA Mandates Federal Agency Patching **CISA** has added **CVE-2026-104935** to its list of actively exploited security flaws. It has ordered federal agencies to secure their networks against these attacks by Friday, in accordance with its June **Binding Operational Directive 26-04**. While **BOD 26-04** primarily applies to Federal Civilian Executive Branch (**FCEB**) agencies, **CISA** has issued a separate advisory urging all security teams and network defenders to patch this vulnerability immediately and conduct thorough checks for signs of compromise. "**CISA** is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [..] **CISA** urges organizations with affected **Ivanti Connect Secure** appliances and deployments to immediately update to the latest version," the agency warned. **CISA** also highlighted that **Ivanti's Integrity Checker Tool** may not detect exploitation of **CVE-2026-104935** because threat actor commands execute in memory, necessitating network and memory forensics for compromise detection. ### Recommended Remediation Steps If compromised **Ivanti ICS** appliances are discovered, **CISA** advises the following actions: 1. Create a backup of the appliance configuration. 2. Perform a factory reset and upgrade the appliance to the latest version (for cloud and virtual systems, rebuild the virtual instance and upgrade). 3. Restore the appliance configuration from the backup. 4. Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials. ### A History of Ivanti Zero-Days This is not the first instance of **Ivanti Connect Secure** zero-days being exploited in the wild. In early January 2024, **Ivanti** addressed an authentication bypass (**CVE-2023-46805**) and a command injection (**CVE-2024-21887**). Two weeks later, another server-side request forgery (**CVE-2024-21893**) was patched. More recently, an **RCE** flaw (**CVE-2025-0282**) was patched in January 2025, followed by another **RCE** vulnerability (**CVE-2025-22457**) that China-linked cyber spies have exploited since mid-March 2025. Since November 2021, **CISA** has added 36 **Ivanti** vulnerabilities to its catalog of actively exploited security issues, with 12 of these also being abused in ransomware attacks.