# Ivanti Connect Secure CVE-2026-104935 zero-day: update now, and know the Integrity Checker may miss it > CISA says attackers are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution, to steal credentials and data. Affected appliances need the latest version now, Ivanti’s Integrity Checker may miss in-memory activity, and version 22.8 reaches end of life on January 31, 2027. - Canonical URL: https://update.dsesecurity.com/updates/ivanti-connect-secure-cve-2026-104935-zero-day-update-factory-reset-22-8-eol-2027/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:22+00:00 - Modified: 2026-10-19T01:55:08+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Playbook - DSE priority: Critical - Topics: Cybersecurity, Networks & Infrastructure - Reading time: 2 minutes ## What you need to know CISA says attackers are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution, to steal credentials and data. Affected appliances need the latest version now, Ivanti’s Integrity Checker may miss in-memory activity, and version 22.8 reaches end of life on January 31, 2027. ## Potentially affected Organizations that run Ivanti Connect Secure VPN appliances, hardware or virtual, and the providers who manage remote access for them. ## DSE recommendation DSE recommends updating every Ivanti Connect Secure appliance to the latest fixed version now and treating any appliance exposed while vulnerable as possibly compromised. ## Article CISA says attackers are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution, to steal credentials and data. Affected appliances need the latest version now, Ivanti’s Integrity Checker may miss in-memory activity, and version 22.8 reaches end of life on January 31, 2027. ## Source facts CISA’s [October 13, 2026 alert](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure) says CVE-2026-104935 affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and that threat actors are exploiting this zero-day authentication bypass, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added it to the Known Exploited Vulnerabilities catalog the same day and urges organizations to update affected appliances to the latest version immediately, noting that version 22.8 reaches end of life on January 31, 2027. CISA says determining whether an appliance was compromised requires network and memory forensics, because Ivanti’s Integrity Checker Tool may not detect exploitation of this flaw when commands execute in memory. For suspected compromise, its recovery steps are to back up the appliance configuration, factory reset and upgrade to the latest version or rebuild cloud and virtual instances, restore the configuration, reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials. ## Applicability Use this for Ivanti Connect Secure hardware and virtual appliances. Check Ivanti’s advisory for the fixed build on each branch, and plan the move off 22.8 before its end of life. ## DSE recommendation DSE recommends updating every Ivanti Connect Secure appliance to the latest fixed version now and treating any appliance exposed while vulnerable as possibly compromised. Do not rely on the Integrity Checker alone, follow the factory-reset recovery steps if there are signs of compromise, reset the credentials and certificates the appliance used, and schedule the move off version 22.8 before January 31, 2027. ## Verification Record each appliance’s version after updating, keep forensic findings or the reason none were needed, and confirm password, certificate and API key resets were completed. ## Official reference [CISA — CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure). Reviewed October 19, 2026. ## Primary reference - Name: CISA — CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Ivanti Connect Secure CVE-2026-104935 zero-day: update now, and know the Integrity Checker may miss it,” DSE Security, https://update.dsesecurity.com/updates/ivanti-connect-secure-cve-2026-104935-zero-day-update-factory-reset-22-8-eol-2027/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.