CISA Alerts on Ivanti Connect Secure Zero-Day Vulnerability
CISA has issued an alert regarding a high-severity authentication bypass zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure, affecting multiple versions and allowing unauthorized access to systems.
Vulnerability Details and Exploitation
CISA has issued an alert regarding a newly exploited vulnerability in Ivanti Connect Secure, identified as CVE-2026-104935. This high-severity authentication bypass zero-day affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Ivanti confirmed on October 13 that it is aware of 'limited exploitation in the wild.' The vulnerability allows unauthorized access to systems, potentially leading to further exploitation. CISA urges organizations using affected versions to apply patches immediately to mitigate risks. The flaw was disclosed by Ivanti and tracked as CVE-2026-104935. No specific details about the exploitation methods or affected industries have been provided by Ivanti or CISA in the alert.
Impact and Recommendations from CISA
CISA has issued urgent guidance following the discovery of a zero-day authentication bypass vulnerability in Ivanti Connect Secure, which allows threat actors to execute arbitrary commands remotely without authentication. This exploit enables credential theft and data exfiltration, posing significant risks to affected organizations. CISA urges organizations using impacted Ivanti Connect Secure appliances to immediately apply the latest security patches, as detailed in Ivanti’s Security Advisory (CVE-2026-104935). According to Ivanti, users running vulnerable versions should act promptly to mitigate potential breaches. The vulnerability highlights the importance of timely patch management and continuous monitoring of network infrastructure. Organizations are advised to consult Ivanti’s advisory for specific remediation steps and ensure all systems are updated to the latest version. Failure to address this issue could result in unauthorized access and compromise of sensitive data.
Exploitation Techniques and Detection Challenges
CISA has emphasized the urgency of patching the newly exploited vulnerability in Ivanti Connect Secure, highlighting the sophisticated techniques used by threat actors. According to Volexity, attackers are executing commands in memory rather than modifying persistent system files, which makes detection more challenging. This approach allows them to re-exploit the device for every command they run, further complicating efforts to trace their activities. Additionally, threat actors are tampering with logs to cover their tracks, effectively evading detection by Ivanti’s Integrity Checker Tool. Volexity noted that the tool may not detect evidence of exploitation because the exploit changes library code only in memory and restores the configuration data it alters. These evasion tactics underscore the need for organizations to apply patches promptly and implement additional monitoring measures to identify suspicious activity.
Threat Actor Activity and Chain of Exploits
CISA has urged organizations to patch a newly exploited vulnerability in Ivanti Connect Secure, as threat actors have been actively leveraging it. According to Volexity, a previously unknown threat actor tracked as UTA0576 has been chaining the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to achieve unauthenticated root-level code execution on fully patched devices. The exploitation was first observed in internet-exposed instances of Ivanti Connect Secure, as reported by Shadowserver. In one investigated incident, the attacker accessed the URL path /dana-na/auth/url_default/welcome.cgi in large numbers, with HTTP headers indicating mismatched paths and directory access to /data/.icscap/. The attacker used the IP address 108.165.147[.]64 and stole stored credentials, including LDAP domain credentials, before conducting password-spraying attacks against Active Directory accounts.
Historical Context and Previous Exploits
CISA has historically highlighted the persistent exploitation of Ivanti product vulnerabilities, with 36 such flaws flagged as actively used in attacks since November 2021, according to bleepingcomputer.com. Among these, 12 have been leveraged by ransomware groups, underscoring the ongoing threat posed by unpatched systems. In early January 2024, Ivanti addressed an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), followed by a server-side request forgery (CVE-2024-21893) two weeks later, as noted in bleepingcomputer.com. More recently, Ivanti identified two additional high-severity flaws: CVE-2026-106042 in Xtraction before version 2026.4 and CVE-2026-109412 in Neurons Patch for Intune, both rated 9.9 out of 10 by Ivanti, per thehackernews.com. These findings reinforce the need for continuous monitoring and timely patching to mitigate risks from known exploits.
Sources and reporting notes
Based on published source material. No independent hands-on testing is claimed.
