Ivanti Connect Secure zero-day under active attack
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA warns of active exploitation of an unauthenticated RCE zero-day in Ivanti Connect Secure used for credential theft and data exfiltration.
CISA has issued an alert on CVE-2026-104935, a newly disclosed authentication bypass vulnerability in Ivanti Connect Secure affecting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The flaw allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable appliances, which threat actors are actively exploiting to steal credentials and exfiltrate data. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.
Notably, Ivanti's Integrity Checker Tool may fail to detect exploitation because attacker commands execute in memory rather than touching disk, complicating detection. CISA recommends organizations conduct network and memory forensics to determine compromise rather than relying solely on the ICT. For suspected compromises, CISA outlines a full recovery procedure: backing up configuration, factory resetting and upgrading appliances (or rebuilding virtual instances), restoring configuration, and resetting all credentials, certificates, API keys, and license server credentials.
Defenders should immediately patch to the latest Connect Secure version per Ivanti's advisory and the 25.x Upgrade and Migration Compatibility Guide. Note that version 22.8 reaches end of life January 31, 2027, so organizations on that branch should plan migration alongside patching. CISA also points to Volexity's prior research on chained exploitation of Ivanti Connect Secure zero-days as useful background for understanding related attacker tradecraft.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs