Ivanti Connect Secure CVE-2026-104935 zero-day: update now, and know the Integrity Checker may miss it

CISA says attackers are exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution, to steal credentials and data. Affected appliances need the latest version now, Ivanti’s Integrity Checker may miss in-memory activity, and version 22.8 reaches end of life on January 31, 2027.

Source facts

CISA’s October 13, 2026 alert says CVE-2026-104935 affects Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and that threat actors are exploiting this zero-day authentication bypass, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added it to the Known Exploited Vulnerabilities catalog the same day and urges organizations to update affected appliances to the latest version immediately, noting that version 22.8 reaches end of life on January 31, 2027.

CISA says determining whether an appliance was compromised requires network and memory forensics, because Ivanti’s Integrity Checker Tool may not detect exploitation of this flaw when commands execute in memory. For suspected compromise, its recovery steps are to back up the appliance configuration, factory reset and upgrade to the latest version or rebuild cloud and virtual instances, restore the configuration, reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.

Applicability

Use this for Ivanti Connect Secure hardware and virtual appliances. Check Ivanti’s advisory for the fixed build on each branch, and plan the move off 22.8 before its end of life.

DSE recommendation

DSE recommends updating every Ivanti Connect Secure appliance to the latest fixed version now and treating any appliance exposed while vulnerable as possibly compromised. Do not rely on the Integrity Checker alone, follow the factory-reset recovery steps if there are signs of compromise, reset the credentials and certificates the appliance used, and schedule the move off version 22.8 before January 31, 2027.

Verification

Record each appliance’s version after updating, keep forensic findings or the reason none were needed, and confirm password, certificate and API key resets were completed.

Official reference

CISA — CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure. Reviewed October 19, 2026.