Ivanti Connect Secure Zero-Day (CVE-2026-104935) Exploited
CISA Warns of Actively Exploited Zero-Day in Ivanti Connect Secure
CVE Identifiers
Full Report
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an actively exploited zero-day vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure (ICS) VPN appliances. This authentication bypass vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the device. Threat actors are leveraging this flaw for credential theft and data exfiltration. Due to the high risk and active exploitation, CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate patching. Organizations using affected Ivanti products must apply the provided updates urgently and hunt for signs of compromise.
Vulnerability Details
CVE-2026-104935 is an authentication bypass vulnerability in Ivanti Connect Secure with a CVSS score of 8.6 (High). It allows an unauthenticated attacker to bypass control checks and execute commands on the appliance remotely. This level of access can lead to a full system compromise, enabling the attacker to steal credentials stored on the device, move laterally into the protected network, and exfiltrate sensitive data.
Affected Systems
The vulnerability affects the following versions of Ivanti Connect Secure (ICS):
- 25.1.1.1 and prior
- 25.1.2.2 and prior
- 22.8R2.4 and prior
Ivanti has released patched versions and urges all customers to upgrade immediately. The vendor also notes that version 22.8 will reach its end-of-life on January 31, 2027, and customers should plan to migrate.
Exploitation Status
CISA has confirmed that CVE-2026-104935 is being actively exploited in the wild by unspecified threat actors. Its inclusion in the KEV catalog underscores the urgency, mandating U.S. Federal Civilian Executive Branch (FCEB) agencies to apply the patches by October 16, 2026. All organizations with vulnerable appliances should assume they are being targeted.
Impact Assessment
A compromise of an internet-facing VPN appliance like Ivanti Connect Secure represents a critical breach of the network perimeter. Attackers can gain a strong foothold to launch further attacks against the internal network. The confirmed exploitation for credential theft and data exfiltration means that a successful attack could lead to widespread system compromise, significant data loss, and deployment of ransomware. The fact that the commands are executed in memory makes detection difficult, increasing the dwell time for attackers.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns to identify potential compromise:
CISA notes that Ivanti's internal Integrity Checker Tool (ICT) may not detect this specific threat because exploitation occurs in memory. Organizations must rely on external monitoring and forensic analysis.
Detection & Response
- Network Forensics: Perform a thorough analysis of network traffic logs to and from the Ivanti appliance. Look for spikes in outbound data transfer or connections to suspicious IP addresses. Apply D3FEND's
Network Traffic Analysis. - Memory Forensics: If possible, capture a memory image of the appliance for forensic analysis to identify malicious processes or injected code that would not be visible on the file system.
- Log Review: Scrutinize authentication and web logs on the appliance for signs of brute-force attacks, successful logins from unusual locations, or access to administrative endpoints.
Remediation Steps
Ivanti and CISA recommend the following actions:
- Patch Immediately: Upgrade to a fixed software version as detailed in Ivanti's security advisory.
- Assume Compromise: If running a vulnerable version, assume the appliance has been compromised.
- Backup and Reset: Create a backup of the system configuration, perform a factory reset of the appliance, and then re-import the configuration after upgrading to a patched version.
- Credential Reset: After patching, reset all credentials associated with the appliance, including local user accounts, service accounts, and Active Directory integration accounts. Revoke and reissue all stored certificates and reset any API keys.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying the security updates provided by Ivanti is the most critical step to prevent exploitation.
Mapped D3FEND Techniques:
Network Intrusion Prevention
Using an NIPS to monitor traffic to the Ivanti appliance can help detect and block exploitation attempts based on known signatures.
Restrict access to the Ivanti appliance's management interface to a limited set of internal administrative IP addresses. Do not expose the management interface to the internet.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
Given that the Ivanti Integrity Checker Tool is ineffective against this in-memory exploit, network traffic analysis is a critical detection control. Security teams should immediately configure monitoring for all traffic to and from their Ivanti Connect Secure appliances. Establish a baseline of normal traffic patterns and volumes. Implement alerts for any anomalous outbound connections originating from the ICS appliance itself, as this is a strong indicator of compromise (e.g., C2 beaconing or data exfiltration). Pay close attention to connections to unusual ports or IP addresses with no prior history of communication. Using a network tap or span port is preferable to ensure all traffic is captured without impacting appliance performance. This continuous monitoring is essential for detecting post-exploitation activity.
As a critical hardening measure, organizations must restrict all access to the Ivanti Connect Secure management interface. This interface should never be exposed to the public internet. Use a perimeter firewall or web application firewall (WAF) to create explicit allow rules, permitting access only from a small, well-defined set of internal IP addresses belonging to the security and network administration teams (e.g., a bastion host or privileged access workstation). All other inbound traffic to the management port should be blocked by default. This single control dramatically reduces the attack surface for this and future vulnerabilities, preventing unauthenticated remote attackers from reaching the vulnerable endpoint in the first place.
Timeline of Events
CISA issues an alert and adds CVE-2026-104935 to the KEV catalog.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.