CISA has urged administrators to apply patches to Ivanti Connect Secure appliances after attackers exploited a zero-day vulnerability, tracked as CVE-2026-104935, that enables remote authentication bypass and command execution and can lead to credential theft and data exfiltration.
The agency added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13, 2026. The advisory applies to Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Organizations are advised to follow Ivanti’s security advisory to select the correct update for their deployment.
CISA also pointed administrators to Ivanti’s migration guide, noting that upgrade procedures differ between hardware, cloud, and virtual appliance deployments.
Researchers at Volexity found that an unknown threat actor tracked as UTA0576 began exploiting the flaw on October 3. Volexity started investigating suspicious activity on October 5 and traced it to a Connect Secure appliance running version 22.8R2.4 that had been fully patched at the time. The attackers chained an authentication bypass, a file upload weakness that allowed code execution, and a separate privilege escalation bug.
Combined, these issues allowed the attacker to gain root access on the appliance. Ivanti identifies the authentication bypass and remote code execution components under CVE-2026-104935.
Once they controlled the appliance, the attackers collected stored domain credentials, queried Active Directory, and searched for local administrator passwords and BitLocker recovery keys. Volexity also observed password spraying, network discovery activity, and attempts to recover credentials from captured network traffic.
CISA warned that Ivanti’s Integrity Checker Tool may not detect evidence of this attack because many malicious commands were executed solely in memory. Volexity reported that the attacker modified library code in memory, restored altered configuration entries to conceal changes, and removed selected log entries to hide their activity.
The investigators did not find a persistent web shell or backdoor. Instead, the attacker repeatedly re-ran the exploit chain and received command output via HTTPS responses, making network and memory analysis particularly important when assessing whether an exposed appliance was breached.
CISA urges Ivanti 0-day patch
Volexity said Ivanti released updates addressing the authentication bypass and remote code execution aspects of the flaw on October 13. A separate fix for the privilege escalation issue was still under development when the research was published. Administrators are advised not to delay installing the available update while waiting for the remaining fix.
CISA’s guidance recommends backing up the appliance configuration before performing recovery actions. If compromise is suspected, organizations should perform a factory reset of the appliance and install the latest version. Cloud and virtual instances should be rebuilt and upgraded before restoring any saved configuration.
Recovery must also address any stolen secrets. CISA recommends resetting domain, administrator, and local account passwords; revoking and reissuing stored certificates; and resetting stored API keys and license server credentials. Applying the patch alone does not eliminate the need for these remediation steps.
Administrators can review vendor guidance and prior coverage of the affected and fixed Ivanti releases. Organizations still using the 22.8 branch should plan migration ahead of its January 31, 2027 end-of-life date.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
