CISA Warns of Critical Ivanti Connect Secure Zero-Day Exploited to Steal Credentials

Key Takeaways

• A critical zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure appliances is under active exploitation.
• The flaw allows remote authentication bypass and command execution, leading to credential theft and data exfiltration.
• Affected versions include Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.
• Patches are available, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning for organizations to apply them immediately.

Ivanti Connect Secure Zero-Day Actively Exploited for Credential Theft

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to organizations, advising them to promptly patch Ivanti Connect Secure appliances. This alert comes after attackers were observed actively exploiting a zero-day vulnerability, identified as CVE-2026-104935, which facilitates remote authentication bypass and command execution. This critical flaw has been leveraged by threat actors to steal credentials and exfiltrate sensitive data.

CISA Adds Flaw to Known Exploited Vulnerabilities Catalog

On October 13, 2026, CISA officially added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the severity and active threat posed by this vulnerability. The advisory specifically targets Ivanti Connect Secure versions 25.1.1.1 and older, 25.1.2.2 and older, and 22.8R2.4 and older. Organizations are strongly advised to consult Ivanti’s official security advisories to ensure they apply the correct updates for their specific deployments.

CISA also highlighted the importance of following Ivanti’s migration guide, noting that upgrade procedures can vary significantly across hardware, cloud, and virtual appliance configurations.

Volexity Uncovers Attack Chain

Cybersecurity firm Volexity’s investigation revealed that an unidentified threat actor, tracked as UTA0576, initiated exploitation of these weaknesses as early as October 3. Researchers began probing suspicious activity on October 5, ultimately tracing it back to a Connect Secure appliance running version 22.8R2.4, which was fully patched at the time of the initial compromise. The attack involved a sophisticated chain of vulnerabilities, combining an authentication bypass, a file upload flaw enabling code execution, and a separate privilege escalation vulnerability.

Collectively, these vulnerabilities granted attackers root access, providing them with the highest level of control over the compromised appliance. Ivanti has consolidated the authentication bypass and remote code execution components under the single identifier CVE-2026-104935.

Post-Exploitation Activities

Once inside, the attackers utilized the compromised appliance to harvest stored domain credentials, query Active Directory, and search for local administrator passwords and BitLocker recovery keys. Volexity’s analysis also documented instances of password spraying, network discovery, and attempts to recover credentials from captured network traffic.

CISA has warned that Ivanti’s Integrity Checker Tool may not be sufficient to detect evidence of this attack, as malicious commands are executed primarily in memory. Volexity’s findings corroborated this, showing that attackers modified library code in memory, reverted configuration changes, and selectively removed log entries to conceal their malicious activities.

Interestingly, researchers did not identify any persistent web shells or backdoors used by the attackers. Instead, the threat actor repeatedly executed the exploit chain, receiving command results through standard HTTPS responses. This method of operation emphasizes the critical need for thorough network and memory analysis when assessing whether an exposed appliance has been compromised.

Patch Availability and Recovery Steps

Volexity confirmed that Ivanti released fixes for the authentication bypass and code execution components of the flaw on October 13. While a patch for the separate privilege escalation weakness was still under development at the time of the research publication, administrators are strongly urged not to delay applying the currently available updates.

The CISA alert recommends that organizations back up their appliance configuration before initiating any recovery procedures. In cases of suspected compromise, a factory reset followed by the installation of the latest version is advised. For cloud and virtual deployments, CISA suggests rebuilding and upgrading the instances before restoring any saved configurations.

Crucially, CISA stresses that patching alone is insufficient for full recovery. Organizations must also address potentially stolen secrets. This includes resetting domain, administrator, and local account passwords, revoking and reissuing all stored certificates, and resetting any stored API keys and license server credentials. Organizations utilizing the 22.8 branch should also plan for migration before its end-of-life date on January 31, 2027.

What You Should Do

• Immediately Apply Patches: Update all Ivanti Connect Secure appliances to the latest patched versions as per Ivanti’s security advisories. Do not delay, even if a fix for the privilege escalation flaw is pending.
• Consult Migration Guides: Follow Ivanti’s migration guides, as upgrade paths differ for hardware, cloud, and virtual deployments.
• Perform Thorough Forensics: Conduct detailed network and memory analysis on any exposed appliances to check for signs of compromise, as the Integrity Checker Tool may not detect all indicators.
• Implement Comprehensive Recovery: In cases of suspected or confirmed compromise, perform a factory reset, install the latest software, and then restore a clean configuration. For cloud/virtual deployments, rebuild and upgrade before restoring.
• Reset All Credentials and Secrets: Reset all domain, administrator, and local account passwords. Revoke and reissue all stored certificates, and reset all stored API keys and license server credentials.
• Plan for End-of-Life: If using the 22.8 branch, plan for migration before its January 31, 2027, end-of-life date.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.