CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.

Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction.

Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this security flaw and warned customers to "act immediately" because of "limited exploitation in the wild."

While Ivanti didn't share additional information about ongoing attacks targeting CVE-2026-104935, cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this security issue with two other flaws in attacks since at least October 3rd.

"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935," Volexity said.

"Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys."

Threat intel firm Defused also confirmed Volexity's report, saying it first found evidence that attackers are abusing CVE-2026-104935 in the wild on October 1st.

Internet threat watchdog Shadowserver now tracks over 5,600 Internet-exposed hosts with ICS fingerprints. However, there is no information on how many are secured against ongoing attacks or how many are honeypots designed to catch malicious activity.

​Admins urged to patch vulnerable Ivanti systems

On Tuesday, CISA also added CVE-2026-104935 to its list of actively exploited security flaws and ordered federal agencies to secure their networks against attacks by Friday, as mandated by its June Binding Operational Directive 26-04.

While BOD 26-04 applies only to Federal Civilian Executive Branch (FCEB) agencies, the cybersecurity agency also issued a separate advisory urging all security teams and network defenders to patch this vulnerability immediately and check for evidence of compromise.

"CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [..] CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version," it warned.

"Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. [..] Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."

CISA advised defenders to take the following actions if they discover compromised Ivanti ICS appliances:

1. Create a backup of the appliance configuration.
2. Perform a factory reset and upgrade the appliance to the latest version (for cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version).
3. Restore the appliance configuration from the backup created in step 1.
4. Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.

Ivanti addressed multiple other Connect Secure zero-days exploited in the wild over the last several years, including an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887) in early January 2024, and a server-side request forgery (CVE-2024-21893) two weeks later.

More recently, it patched a remote code execution (RCE) flaw (CVE-2025-0282) in January 2025 and another RCE vulnerability (CVE-2025-22457) that China-linked cyber spies have exploited since at least mid-March 2025.

CISA has added 36 Ivanti vulnerabilities to its list of actively exploited security issues since November 2021, 12 of which have also been abused in ransomware attacks.