The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to update affected Ivanti Connect Secure appliances after confirming active exploitation of CVE-2026-104935. CISA describes the issue as an authentication bypass that can let a remote, unauthenticated attacker execute commands; it says attackers have used the flaw in credential theft and data-exfiltration activity. 1

Which systems are affected

CISA lists Ivanti Connect Secure releases 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier as affected. Ivanti rates the flaw 8.6, “High,” on the CVSS 3.0 scale. The vendor lists fixed releases including 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, and advises customers to update to a fixed version. 1 2

Ivanti said it knew of exploitation affecting a limited number of customers at the time of disclosure. The security firm Volexity, which investigated an intrusion and worked with Ivanti, reported that attackers sought credentials and other secrets from Active Directory environments after compromising a Connect Secure appliance. 2 3

Patching may not be the whole response

CISA warns that its Integrity Checker Tool may not detect this activity because attacker commands can execute in memory. Organizations that suspect an appliance was compromised may need network and memory forensics. CISA also recommends following Ivanti’s recovery procedures, which include rebuilding or resetting the appliance as appropriate and rotating affected credentials, certificates, and API keys. 1

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13 and urged organizations with affected deployments to apply updates promptly. The immediate concern is not just whether a patch is available, but whether an exposed appliance was accessed before it was updated. 1

References

Why It Matters

An authentication bypass on a VPN appliance is a high-value entry point because the device sits at the boundary between the internet and internal systems, and the reported credential theft and exfiltration show that value being realized. The guidance to rebuild or reset appliances and rotate credentials, certificates, and API keys reflects how much trust is concentrated in a single box. The gap between disclosure and confirmed exploitation leaves little room for organizations that have not yet checked whether their devices were accessed.

Sources

1 CISA: Patching newly exploited Ivanti Connect Secure vulnerability 2 Ivanti: Security Advisory for CVE-2026-104935 3 Volexity: Exploitation of Ivanti Connect Secure zero-days