CISA Urges Immediate Patching of Ivanti Connect Secure Zero-Day CVE-2026-104935

Attackers are actively exploiting a critical zero-day authentication bypass vulnerability in Ivanti Connect Secure (ICS) appliances, prompting urgent patch advisories from security researchers and CISA. Tracked as CVE-2026-104935, the flaw allows remote, unauthenticated attackers to bypass access controls and execute arbitrary commands with full root privileges. In the wild, threat actors have been leveraging this vulnerability since at least October 1 to compromise edge infrastructure, harvest domain credentials, and extract sensitive security keys.

Active Exploitation of Ivanti Connect Secure CVE-2026-104935

Cybersecurity firm Volexity observed an unknown threat actor tracked as UTA0576 chaining CVE-2026-104935 with secondary flaws in target environments starting around October 3, while threat intel firm Defused identified evidence of wild exploitation dating back to October 1. The attack sequence combines an authentication bypass with remote code execution (RCE) and local privilege escalation contained within the single CVE classification.

Because Ivanti Connect Secure appliances sit directly on network perimeters to terminate remote access connections, compromising the device gives an adversary unauthenticated root-level code execution on a trusted network gateway. The exploit requires low operational complexity and no user interaction, making it ideal for rapid initial access into enterprise environments.

Post-Exploitation Tactics and Blast Radius

Once UTA0576 establishes root access on an exposed appliance, post-exploitation activity quickly focuses on internal discovery and credential harvesting. In observed breaches, the threat actor pivoted deeper into internal networks to target Active Directory infrastructure, specifically seeking out secrets stored within domain databases and management services.

Specifically, attackers targeted:

• Local Administrator Password Solution (LAPS) Passwords: Stealing LAPS credentials provides the attacker with local administrator passwords for domain-joined endpoints across the entire fleet, enabling seamless lateral movement.
• BitLocker Recovery Keys: Extracting full-disk encryption keys stored in Active Directory allows threat actors to bypass disk encryption controls on stolen or imaged system drives.

Data from threat watchdog Shadowserver shows over 5,600 Internet-exposed hosts with Ivanti Connect Secure fingerprints worldwide. Given that edge SSL VPN appliances often serve as the root of trust for corporate network segments, any unauthenticated perimeter breach presents immediate catastrophe for affected organizations.

Stealth Execution and Integrity Checker Limitations

Detecting compromise associated with CVE-2026-104935 poses notable challenges for security operations teams. The threat actor executes commands directly in system memory rather than dropping persistent files onto disk.

Because of this memory-only execution technique, Ivanti’s native Integrity Checker Tool (ICT) may fail to flag active or historical exploitation. Security teams relying solely on standard file integrity monitoring or automated ICT scans risk missing active intrusions. Proper detection requires inspecting external network flow logs, monitoring outbound connections from appliance management interfaces, and conducting memory forensics on suspect instances.

Remediation and Mandatory Response Protocols

Ivanti has released patched firmware builds to fix the security flaw, issuing Connect Secure versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. CISA added CVE-2026-104935 to its list of actively exploited vulnerabilities and ordered Federal Civilian Executive Branch (FCEB) agencies to secure vulnerable systems by Friday under Binding Operational Directive 26-04.

Because memory-resident execution leaves open the possibility of persistent internal access via stolen credentials, simply applying the patch over a compromised host is insufficient. Network defenders managing affected Ivanti Connect Secure deployments should complete a full containment and rebuild protocol:

1. Rebuild or Reset the Appliance: For physical appliances, perform a complete factory reset prior to applying patches. For virtual and cloud deployments, destroy the compromised virtual machine instance, provision a clean image, and update immediately to fixed versions (22.8R2.5, 25.1.3.0, 25.1.3.1, or 25.1.1.2).
2. Restore Known-Good Configurations: Re-import device configurations only from backups verified to have been created prior to October 1.
3. Reset Identity and Trust Boundaries: Reset passwords for all domain, administrative, and local user accounts exposed to the device. Revoke and reissue all stored client and server certificates, API keys, and license server credentials.

This incident marks the latest in a multi-year trend of zero-day exploitation against Ivanti edge products, following similar perimeter flaws including CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282, and CVE-2025-22457. Perimeter remote-access appliances remain high-value targets for sophisticated threat groups seeking direct network access.