/
← Voltar ao feed
critical

Ivanti Connect Secure zero-day CVE-2026-104935 exploited for unauthenticated RCE, credential theft and data exfiltration; added to CISA KEV

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 09:00 · coletado há 1 dia

CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026 and urges immediate patching. The article does not attribute the activity to a named actor.

Technical Details

  • Affected versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
  • Threat actor commands execute in memory, so Ivanti's Integrity Checker Tool may not detect exploitation. Determining compromise requires network and memory forensics.
  • CISA points to the Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" for further context.
  • Version 22.8 reaches end of life on Jan. 31, 2027.

Remediation

  • Immediately update to the latest version per Ivanti's Security Advisory for CVE-2026-104935, and review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
  • If compromise is suspected, follow the Ivanti Connect Secure Recovery Procedures: back up the appliance configuration, factory reset and upgrade (for cloud and virtual systems, rebuild the instance and upgrade), then restore the configuration from the backup.
  • Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.

Linha do tempo

  1. cisa.gov ↗ · pub. 13/10/2026 09:00 · coletado 19/10 18:37 primeiro registro

    Ivanti Connect Secure zero-day CVE-2026-104935 exploited for unauthenticated RCE, credential theft and data exfiltration; added to CISA KEV

    ler a análise desta fonte

    CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026 and urges immediate patching. The article does not attribute the activity to a named actor.

    Technical Details

    • Affected versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
    • Threat actor commands execute in memory, so Ivanti's Integrity Checker Tool may not detect exploitation. Determining compromise requires network and memory forensics.
    • CISA points to the Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" for further context.
    • Version 22.8 reaches end of life on Jan. 31, 2027.

    Remediation

    • Immediately update to the latest version per Ivanti's Security Advisory for CVE-2026-104935, and review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
    • If compromise is suspected, follow the Ivanti Connect Secure Recovery Procedures: back up the appliance configuration, factory reset and upgrade (for cloud and virtual systems, rebuild the instance and upgrade), then restore the configuration from the backup.
    • Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.