Source: cisa.gov
CISA has issued an alert regarding CVE-2026-104935, a zero-day authentication bypass vulnerability in Ivanti Connect Secure affecting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The vulnerability allows remote, unauthenticated execution of arbitrary commands, enabling credential theft and data exfiltration. Threat actors are actively exploiting this vulnerability in the wild. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog as of October 13, 2026. Organizations are urged to immediately update to the latest version of Ivanti Connect Secure. Notably, Ivanti's Integrity Checker Tool may not detect exploitation because threat actor commands execute in memory, requiring network and memory forensics for compromise detection. CISA recommends a recovery process including factory reset, upgrade, configuration restore, and credential/certificate rotation. Ivanti Connect Secure version 22.8 reaches end of life on January 31, 2027.
