U.S. Cyber Agency Says an Ivanti Connect Secure Flaw Is Under Attack, and Tells Users to Update Now
The U.S. Cybersecurity and Infrastructure Security Agency said on Oct. 13, 2026, that cyber threat actors are exploiting a previously unknown flaw in Ivanti Connect Secure, tracked as CVE-2026-104935. The agency urged every organization running an affected appliance to update to the latest version immediately, as outlined in Ivanti's security advisory.
Ivanti Connect Secure is the gateway appliance that staff log in to from outside to reach an internal network. The versions listed as affected are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA's alert describes the flaw as a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands, with no login needed. The same alert says it is being used to steal credentials and take data out.
CISA added the identifier to its Known Exploited Vulnerabilities Catalog the same day. Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, requires federal civilian executive branch agencies to prioritize rapid remediation of catalog-listed flaws on publicly exposed systems that would give an attacker total control. The directive binds only those agencies, and CISA encourages all other organizations to treat the catalog the same way.
The alert also warns that Ivanti's Integrity Checker Tool may not detect evidence that this flaw has been exploited, because the commands run in memory, and that establishing whether an appliance was compromised will take network and memory forensics.
For an appliance suspected of compromise, CISA relays Ivanti's recovery procedure: back up the configuration, factory reset the appliance and upgrade it, rebuild cloud and virtual instances, then restore the configuration from the backup. Passwords for domain, administrator and local accounts should then be reset, stored certificates revoked and reissued, and stored API keys and license server credentials reset.
CISA also notes that Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027. The Ivanti bypass was one of two entries added to the catalog that day; the other, CVE-2026-96951, is a command injection flaw in Microsoft Windows.
