The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately update vulnerable Ivanti Connect Secure appliances after confirming active exploitation of a critical zero-day vulnerability, CVE-2026-104935. The flaw enables attackers to bypass authentication and execute commands remotely, creating a pathway for credential theft, unauthorized network access, and large-scale data compromise.
On October 13, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the immediate threat posed to organizations running affected versions of Ivanti Connect Secure. The issue impacts deployments running 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Administrators are advised to consult Ivanti’s security guidance to determine the appropriate remediation path for their specific environment.
Because upgrade and migration requirements vary depending on whether an organization uses hardware appliances, cloud-based instances, or virtual deployments, CISA has also directed customers to Ivanti's migration documentation before applying updates.
Security researchers at Volexity revealed that exploitation activity began as early as October 3, with attacks attributed to an unidentified threat actor tracked as UTA0576. During incident response efforts conducted on October 5, researchers discovered evidence of compromise on an Ivanti Connect Secure appliance running version 22.8R2.4, despite the system having all available security updates installed at the time.
The intrusion relied on a sophisticated exploit chain that combined multiple vulnerabilities. Attackers first leveraged an authentication bypass flaw to gain unauthorized access, then abused a file upload weakness to execute malicious code, before exploiting an additional privilege escalation issue to gain elevated permissions. Together, these vulnerabilities ultimately provided attackers with root-level access, granting unrestricted control over the device.
Ivanti has assigned CVE-2026-104935 to the authentication bypass and remote code execution components of the attack chain.
Once access was established, attackers focused on harvesting sensitive information from the compromised appliance. Researchers observed threat actors extracting cached domain credentials, querying Active Directory environments, searching for privileged administrator passwords, and collecting BitLocker recovery keys that could facilitate further compromise across enterprise networks.
Additional malicious activity included password-spraying attempts, internal network reconnaissance, and efforts to recover credentials from captured network traffic. These actions indicate that the attackers were actively seeking opportunities for lateral movement and broader domain compromise.
Investigators also warned that traditional forensic methods may fail to detect the intrusion. According to CISA, Ivanti’s Integrity Checker Tool (ICT) may not reliably identify evidence of exploitation because many malicious actions occur entirely in memory rather than being written to disk.
Volexity found that the attackers actively manipulated in-memory libraries, reverted system configuration changes after executing their payloads, and selectively removed log entries to obscure their presence. These stealth techniques significantly reduce the effectiveness of standard security monitoring and forensic investigations.
Notably, researchers did not uncover any persistent web shells or conventional backdoors on affected systems. Instead, the threat actor repeatedly executed the exploit chain whenever access was needed and received command output through encrypted HTTPS responses. This approach minimizes persistent artifacts on the appliance and makes compromise detection heavily dependent on deep network monitoring and memory analysis.
Immediate Action Required
Ivanti released patches addressing the authentication bypass and remote code execution vulnerabilities on October 13, 2026. However, the accompanying privilege-escalation flaw remained under development at the time the findings were disclosed.
Security experts stress that organizations should deploy the available fixes immediately rather than delaying remediation while waiting for additional updates.
For environments suspected of compromise, CISA recommends a comprehensive recovery process that extends well beyond patch installation. Organizations should:
- Back up appliance configurations before beginning remediation.
- Perform a complete factory reset of affected hardware.
- Reinstall the latest secure software version.
- Rebuild cloud and virtual appliances from trusted images.
- Restore only verified clean configurations.
Because attackers may have stolen sensitive credentials and cryptographic material during exploitation, organizations should also assume that exposed secrets have been compromised. Recommended recovery measures include:
- Resetting Active Directory, administrator, and local account passwords.
- Revoking and reissuing digital certificates stored on affected systems.
- Rotating API keys and service credentials.
- Updating license server authentication details and other embedded secrets.
CISA emphasized that applying security patches alone is insufficient if compromise has already occurred. Full credential rotation and recovery procedures are necessary to eliminate attacker access.
Organizations running the 22.8 release branch should also begin planning migration efforts ahead of the product's scheduled end-of-life date of January 31, 2027, as continued use of unsupported versions will increase long-term security risk.
The incident serves as another reminder that internet-facing remote access infrastructure remains a prime target for advanced threat actors, particularly when vulnerabilities provide direct pathways to credential theft, privilege escalation, and enterprise-wide compromise.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
