CISA 2026-10-13

CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CVE-2026-104935 +1

Machine-generated analysis · WAYSCloud LLM

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.

Context

The advisory concerns Ivanti Connect Secure appliances (versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier). It states the zero-day authentication bypass enables remote, unauthenticated command execution that can be used for credential theft and data exfiltration. The advisory notes that Ivanti’s Integrity Checker may not detect exploitation because the malicious commands run only in memory.

Operator considerations

Check: Verify appliance version against the listed vulnerable releases.
Patch: Update to the latest Ivanti Connect Secure version per the vendor’s security advisory.
Log: Perform network and memory forensics to look for signs of exploitation.

From Cybersecurity and Infrastructure Security Agency ↗

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026.

CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935). Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appl...

Read the full advisory on CISA →