CISA Issues Urgent Warning Over Actively Exploited Ivanti Connect Secure Zero-Day Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a critical advisory on Tuesday, sounding the alarm over a newly discovered zero-day vulnerability impacting Ivanti Connect Secure (ICS) appliances. The agency is urging all organizations utilizing the affected software to prioritize immediate updates, citing confirmed reports of active exploitation by cyber threat actors. The vulnerability, which allows for unauthenticated remote code execution, has already been utilized in the wild to facilitate credential theft and the exfiltration of sensitive corporate data.

The security flaw is officially tracked as CVE-2026-104935 and has been assigned a CVSS score of 8.6, reflecting its high severity and the relative ease with which it can be exploited. At its core, the vulnerability is an authentication bypass flaw that resides within the gateway’s handling of certain web requests. According to technical disclosures, the issue impacts several iterations of the software, specifically Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. If left unpatched, the flaw provides a pathway for a remote, unauthenticated attacker to bypass standard security protocols and execute arbitrary commands on the underlying system.

In its public alert, CISA emphasized the gravity of the situation, noting that the agency is aware of threat actors actively leveraging this zero-day to gain initial access to target networks. Once access is established through the authentication bypass, attackers are moving quickly to steal administrative credentials and harvest data from the compromised environments. The ability to execute commands without needing valid login credentials makes this a particularly potent weapon for both state-sponsored espionage groups and financially motivated cybercriminals.

Following the confirmation of active exploitation, CISA took the additional step of adding CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog. This designation carries significant weight, particularly for Federal Civilian Executive Branch (FCEB) agencies. Under the terms of Binding Operational Directive (BOD) 22-01, federal agencies are now mandated to apply the necessary security patches by a strict deadline of October 16, 2026. While the mandate technically applies only to federal entities, CISA strongly recommends that private sector organizations, critical infrastructure providers, and state and local governments follow the same accelerated patching timeline to mitigate the risk of compromise.

Beyond the immediate patching requirements, CISA is also drawing attention to the looming end-of-life (EOL) status for older versions of the software. Organizations currently running version 22.8 are being cautioned that this specific branch is scheduled to reach end-of-life on January 31, 2027. CISA is recommending that customers review Ivanti’s Connect Secure Upgrade and Migration Compatibility Guide to ensure they are moving toward supported versions that will continue to receive security updates in the future. The agency warned that continuing to operate EOL software creates an inherent security vacuum that attackers are increasingly adept at filling.

For organizations that suspect they may have already been targeted, the road to recovery is complex. CISA noted that identifying evidence of a breach involving this specific vulnerability requires more than a simple log review. Because the exploit occurs at a low level within the appliance’s architecture, organizations seeking to determine whether they were compromised will need to conduct comprehensive network and memory forensics. This involves analyzing volatile memory for signs of unauthorized processes and inspecting network traffic for the specific signatures associated with the bypass.