# Ivanti Connect Secure zero-day under active attack

Published: 2026-10-13 · Severity: severe · Sectors: technology, government-national
Canonical: https://vorant.io/reports/92eba3bb-4227-554f-8770-9ae13808c209/ivanti-connect-secure-zero-day-under-active-attack

> CISA warns of active exploitation of an unauthenticated RCE zero-day in Ivanti Connect Secure used for credential theft and data exfiltration.

CISA has issued an alert on CVE-2026-104935, a newly disclosed authentication bypass vulnerability in Ivanti Connect Secure affecting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The flaw allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable appliances, which threat actors are actively exploiting to steal credentials and exfiltrate data. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

Notably, Ivanti's Integrity Checker Tool may fail to detect exploitation because attacker commands execute in memory rather than touching disk, complicating detection. CISA recommends organizations conduct network and memory forensics to determine compromise rather than relying solely on the ICT. For suspected compromises, CISA outlines a full recovery procedure: backing up configuration, factory resetting and upgrading appliances (or rebuilding virtual instances), restoring configuration, and resetting all credentials, certificates, API keys, and license server credentials.

Defenders should immediately patch to the latest Connect Secure version per Ivanti's advisory and the 25.x Upgrade and Migration Compatibility Guide. Note that version 22.8 reaches end of life January 31, 2027, so organizations on that branch should plan migration alongside patching. CISA also points to Volexity's prior research on chained exploitation of Ivanti Connect Secure zero-days as useful background for understanding related attacker tradecraft.

## Mentioned in this report

- Vulnerabilities: CVE-2026-104935 (KEV)

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/92eba3bb-4227-554f-8770-9ae13808c209/ivanti-connect-secure-zero-day-under-active-attack.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup