This Affects the Following ISC Versions: 

• 25.1.1.1 and prior

• 25.1.2.2 and prior

• 22.8R2.4 and prior

CISA warns that threat actors are exploiting this flaw, allowing them to steal credentials and data. 

Defending Against This Flaw

Shane Barney, Chief Information Security Officer at Keeper Security, comments, “The newly disclosed zero-day in Ivanti Connect Secure (CVE-2026-104935) is under active exploitation, and what makes it dangerous is the chain. Threat actors like UTA0576 pair authentication bypass and remote code execution with privilege escalation to go from unauthenticated access to root control of the appliance. 

“With root access on the appliance, the device stops protecting the network and becomes an attacker-controlled pivot point. In the one incident Volexity investigated, the attacker stole stored credentials, including LDAP domain credentials, searched Active Directory for passwords and ran password-spraying attacks. Valid credentials are harder to spot than malware, which is part of why this chain is so hard to contain.”

The flaw has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Therefore, Federal Civilian Executive Branch (FCEB) agencies are mandated to apply the fixes by October 16, 2026. 

Furthermore, CISA recommends those with affected ISC deployments find patching guidance in Ivanti's Connect Secure Upgrade and Migration Compatibility Guide. 

Robert Costello, Chief Digital and Information Officer at Merlin Group, states, “Having spent years responsible for running and securing large government networks, I know firsthand how difficult it is to manage these risks. Ivanti Connect Secure is a good example of why edge devices are particularly attractive targets. They sit at critical points in our networks, providing important protections, but they may also have significant access, while visibility can be limited. Attackers are now increasingly using AI to accelerate vulnerability discovery, automate exploit development, and scale reconnaissance across exposed systems. That makes it easier to chain vulnerabilities together, turning an authentication bypass into remote code execution and privilege escalation. These aren’t always isolated issues, and the combined risk can be far greater than any single vulnerability.

“CISA’s guidance on securing edge devices and BOD 26-04 provides a good model, and not just for federal agencies. State and local governments, critical infrastructure operators, and the private sector should look to the same approach. Know what’s exposed, prioritize vulnerabilities being actively exploited, reduce unnecessary access, and improve monitoring. Critical protections are important, but zero trust must be incorporated throughout systems, not just at the edge. Organizations need to concentrate their efforts where the risk is greatest, especially as AI enables attackers to move faster and operate at greater scale.

If an organization is unsure if it has been compromised, CISA urges it to conduct memory and network forensics to detect exploitation evidence. However, Ivanti’s Integrity Checker Tool may not identify signs of CVE-2026-104935 exploitation because the actor commands execute in memory. 

Tim Mackey, Head of Software Supply Chain Risk Strategy at Black Duck, comments, “While combining attack vectors from multiple vulnerabilities is nothing new, all cyber defenders and software producers should focus not on just resolving CVEs with high CVSS or EPSS scores but instead look at how vulnerability chains could operate within their software stacks. After all, agentic attackers are chaining vulnerabilities in creative ways but doing so at AI speed and challenging legacy CVE triage processes.” 

Barney concludes, “Beyond patching, security teams should remove standing administrative privileges and enforce least-privilege access. Enable phishing-resistant multi-factor authentication for every privileged login, rotate passwords for domain, admin and local accounts as CISA recommends, and vault and automatically rotate privileged credentials so a stolen password goes stale quickly.”