Feds Issue Ivanti Advisory
Ivanti just disclosed a new exploited vulnerability affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and CISA just released an advisory to raise the level of awareness for security professionals.
Cyber threat actors are exploiting this Zero Day authentication bypass vulnerability (CVE-2026-104935), which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.
Additionally, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog Tuesday, October 13.
CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version. An update ended up outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935).
Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.
Organizations seeking to determine whether they ended up compromised will need to conduct network and memory forensics to identify evidence of exploitation. Furthermore, Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.
If your organization suspects a compromise, CISA recommends implementing the following actions:
- Create a backup of the appliance configuration. Review Ivanti’s How to Backup & Restore the Binary Configuration Using Archiving Server for more information.Â
- Conduct a factory reset and upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
- Restore the appliance configuration from the backup created in step 1.
- Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.