CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

CVE-2026-104935 is a high-severity authentication bypass vulnerability in Ivanti Connect Secure appliances that enables unauthenticated remote attackers to execute arbitrary commands with low complexity and no user interaction. Exploitation has been observed since early October 2026, including chaining with other vulnerabilities to achieve unauthenticated root-level code execution. Post-exploitation activities include theft of Active Directory credentials, LAPS passwords, and BitLocker recovery keys. Ivanti released patched versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 to address this flaw. CISA has added this vulnerability to its actively exploited list and issued binding directives for federal agencies to patch immediately. Mitigation requires upgrading to the latest versions and conducting forensic analysis for potential compromise.

The vulnerability allows remote, unauthenticated attackers to bypass authentication and execute arbitrary commands on Ivanti Connect Secure appliances. This can lead to full system compromise, including root-level code execution. Attackers have used this flaw to steal sensitive credentials such as Active Directory secrets, LAPS passwords, and BitLocker recovery keys, enabling further lateral movement and data exfiltration. The flaw has been actively exploited in the wild since at least October 1, 2026, posing a significant risk to affected organizations.

Ivanti has released patched versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 that address CVE-2026-104935. Organizations should immediately update affected Ivanti Connect Secure appliances to these versions. CISA mandates federal agencies to patch by the specified deadline and recommends all organizations do the same. If compromise is suspected, conduct network and memory forensics as Ivanti's Integrity Checker Tool may not detect in-memory exploitation. In case of confirmed compromise, backup appliance configuration, perform a factory reset or rebuild virtual instances, upgrade to the latest version, restore configuration, reset all passwords, and revoke/reissue certificates, API keys, and license credentials.