The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to update affected Ivanti Connect Secure appliances after confirming active exploitation of CVE-2026-104935. CISA describes the issue as an authentication bypass that can let a remote, unauthenticated attacker execute commands; it says attackers have used the flaw in credential theft and data-exfiltration activity. 1
Which systems are affected
CISA lists Ivanti Connect Secure releases 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier as affected. Ivanti rates the flaw 8.6, “High,” on the CVSS 3.0 scale. The vendor lists fixed releases including 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, and advises customers to update to a fixed version. 1 2
Ivanti said it knew of exploitation affecting a limited number of customers at the time of disclosure. The security firm Volexity, which investigated an intrusion and worked with Ivanti, reported that attackers sought credentials and other secrets from Active Directory environments after compromising a Connect Secure appliance. 2 3
Patching may not be the whole response
CISA warns that its Integrity Checker Tool may not detect this activity because attacker commands can execute in memory. Organizations that suspect an appliance was compromised may need network and memory forensics. CISA also recommends following Ivanti’s recovery procedures, which include rebuilding or resetting the appliance as appropriate and rotating affected credentials, certificates, and API keys. 1
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 13 and urged organizations with affected deployments to apply updates promptly. The immediate concern is not just whether a patch is available, but whether an exposed appliance was accessed before it was updated. 1