Critical Zero-Day in Ivanti Connect Secure Under Active Exploitation: CISA Urges Immediate Patching
A newly disclosed zero-day vulnerability, **CVE-2026-104935**, in **Ivanti Connect Secure** appliances is being actively exploited by cyber threat actors. This critical authentication bypass flaw allows for remote, unauthenticated command execution, leading to credential theft and data exfiltration. **CISA** has added this vulnerability to its Known Exploited Vulnerabilities Catalog, emphasizing the urgent need for organizations to update.
# Critical Zero-Day in Ivanti Connect Secure Under Active Exploitation: CISA Urges Immediate Patching
**CISA** has issued an urgent warning regarding a critical, actively exploited vulnerability, **CVE-2026-104935**, affecting multiple versions of **Ivanti Connect Secure** appliances. This zero-day authentication bypass allows remote, unauthenticated attackers to execute arbitrary commands, posing a severe risk of credential theft and data exfiltration.
The vulnerability impacts **Ivanti Connect Secure** versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. **CISA** added **CVE-2026-104935** to its **Known Exploited Vulnerabilities (KEV) Catalog** on October 13, 2026, underscoring the immediate threat.
## Immediate Action Required
Organizations utilizing affected **Ivanti Connect Secure** appliances are strongly urged to update immediately to the latest available version. Detailed patching guidance can be found in **Ivanti**'s [Security Advisory Ivanti Connect Secure (CVE-2026-104935)](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US) and the [Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide](https://hub.ivanti.com/s/article/Ivanti-Connect-Secure-25-x-Upgrade-and-Migration-Compatibility-Guide?language=en_US).
It's also important to note that **Ivanti Connect Secure** version 22.8 will reach its end-of-life on January 31, 2027.
## Detecting Compromise and Recovery Steps
Identifying a compromise related to **CVE-2026-104935** requires thorough network and memory forensics, as **Ivanti**'s **Integrity Checker Tool** may not detect evidence of exploitation due to the in-memory execution of threat actor commands.
If a compromise is suspected, **CISA** recommends the following recovery steps, based on **Ivanti Connect Secure Recovery Procedures**:
1. **Backup Configuration**: Create a backup of the appliance configuration. Refer to **Ivanti**'s [How to Backup & Restore the Binary Configuration Using Archiving Server](https://hub.ivanti.com/s/article/KB44759?language=en_US) for instructions.
2. **Factory Reset and Upgrade**: Perform a factory reset and then upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and then upgrade.
3. **Restore Configuration**: Restore the appliance configuration from the backup created in step 1.
4. **Reset Credentials**: Reset passwords for all accounts (domain, administrator, local). Revoke and reissue all stored certificates, and reset stored API keys and license server credentials.
## Further Resources
**CISA** also recommends reviewing the **Volexity** blog post, "[A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)", for additional insights into the exploitation chain.
## Disclaimer
The information provided is for informational purposes only. **CISA** does not endorse any commercial entity, product, company, or service mentioned or linked within this document.