The U.S. Cybersecurity and Infrastructure Security Agency has called on administrators to urgently deploy patches for a critical flaw in Ivanti Connect Secure that attackers have been weaponizing in zero-day campaigns since at least October 1st. Designated CVE-2026-104935, the vulnerability is a high-severity authentication bypass that permits unauthenticated remote actors to run arbitrary code on vulnerable ICS deployments with minimal effort and no user involvement required.
Ivanti released patched versions—22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2—on Tuesday to remediate the flaw. The vendor instructed customers to "act immediately" given the presence of "limited exploitation in the wild."
Security researchers at Volexity disclosed that an adversary tracked as UTA0576 has been chaining CVE-2026-104935 with two additional vulnerabilities since October 3rd. According to Volexity, "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935." The threat actor subsequently harvested Active Directory credentials, Local Administrator Password Solution passwords, and BitLocker recovery keys from compromised systems.
Threat intelligence firm Defused corroborated Volexity's findings, noting that it detected the first evidence of CVE-2026-104935 exploitation on October 1st. Internet monitoring service Shadowserver has catalogued more than 5,600 Internet-accessible hosts running ICS, though the number of systems actually protected against ongoing attacks or operating as honeypots remains unknown.
Federal mandate and broader guidance
CISA added CVE-2026-104935 to its catalog of actively exploited vulnerabilities on Tuesday and issued a directive requiring federal agencies to remediate the issue by Friday under its June Binding Operational Directive 26-04. While BOD 26-04 applies exclusively to Federal Civilian Executive Branch entities, CISA simultaneously released guidance for all organizations, recommending immediate patching and forensic investigation to detect signs of compromise.
"CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. [..] CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version," the agency stated.
CISA cautioned that organizations investigating potential compromise will require network and memory forensics to uncover exploitation evidence. The agency noted that "Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory."
For administrators who identify compromised Ivanti ICS appliances, CISA outlined the following remediation steps:
- Create a backup of the appliance configuration.
- Perform a factory reset and upgrade the appliance to the latest version (for cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version).
- Restore the appliance configuration from the backup created in step 1.
- Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
Pattern of exploitation in Ivanti products
CVE-2026-104935 represents the latest in a series of zero-day vulnerabilities discovered in Ivanti Connect Secure over recent years. The vendor patched an authentication bypass (CVE-2023-46805) and a command injection flaw (CVE-2024-21887) in early January 2024, followed by a server-side request forgery vulnerability (CVE-2024-21893) two weeks later.
More recent patches addressed a remote code execution vulnerability (CVE-2025-0282) in January 2025 and another RCE flaw (CVE-2025-22457) that Chinese state-sponsored actors have weaponized since at least mid-March 2025.
Since November 2021, CISA has catalogued 36 Ivanti vulnerabilities as actively exploited in the wild, with 12 of those also leveraged in ransomware operations.