(TLP:CLEAR) Vulnerability Notification – CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure CVE-2026-104935 Used in Unauthenticated Root-Level RCE Chain

ACTION MAY BE REQUIRED for utilities using affected Ivanti Connect Secure appliances. Utilities that outsource technology support should consult their service providers for assistance with remediation actions.

CVE-2026-104935 is an actively exploited, high-severity authentication-bypass vulnerability in Ivanti Connect Secure. The flaw enables a remote attacker with no credentials to execute arbitrary commands on an affected appliance. Organizations using Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, or 22.8R2.4 and prior should apply the applicable fixed release immediately and investigate for possible Active Directory credential compromise. Updating the appliance closes the known entry path, but it does not remediate credential theft or establish that attackers did not access internal systems.

Summary: Ivanti disclosed active exploitation of CVE-2026-104935 on 13 October 2026 and released patches the same day. The authentication-bypass and remote code execution (RCE) vulnerability affects Ivanti Connect Secure versions 22.8R2.4, 25.1.2.2, and 25.1.1.1 and earlier. Remote, unauthenticated threat actors can use the flaw in a low-complexity attack chain to execute arbitrary commands on vulnerable appliances. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027.

Cybersecurity research company Volexity reported that it observed a previously unknown threat actor, tracked as UTA0576, exploiting a zero-day chain against a fully patched Ivanti Connect Secure appliance in early October 2026. The chain combined an authentication bypass, a file write vulnerability, and a privilege escalation issue to achieve unauthenticated root-level code execution. The current patches only resolve the authentication bypass and RCE components. However, Volexity stated Ivanti is still working on a separate patch to resolve the privilege escalation vulnerability.

No malware. Researchers from Volexity report attackers chaining three previously unknown vulnerabilities to gain full administrative control of an appliance that was fully patched at the time. Notably, the attackers did not install malware or a web shell. Instead, they repeatedly exploited the device to run commands and concealed their activity. As a result, the absence of malware or a clean Ivanti Integrity Checker result does not rule out compromise.

Credential theft and Active Directory reconnaissance. Volexity observed credential theft and AD reconnaissance, including use of the appliance’s AD service account to search for local administrator passwords. Organizations should examine unusual AD queries, service-account activity, and subsequent use of potentially exposed credentials to determine whether attackers accessed other systems.

Mitigation: Members using affected Ivanti Connect Secure appliances should prioritize three actions:

• Patch affected appliances immediately using the applicable Ivanti fixed release.
• Investigate potential credential exposure and internal access, using network and memory evidence rather than relying solely on file-integrity checks.
• If compromise is suspected, preserve evidence, reset or rebuild the appliance, and rotate potentially exposed passwords and other stored secrets.

Patching Guidance and Compromise Assessment:

• For detailed patching instructions for hardware and virtual appliance deployments, review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
• To determine whether exploitation occurred, organizations should conduct network and memory forensics
• Ivanti’s Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because threat actor commands execute in memory.
• If compromise is suspected, CISA recommends following the actions outlined in the Ivanti Connect Secure Recovery Procedures.

Additional Reading:

• CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

Previous WaterISAC Ivanti Connect Secure Posts:

• https://www.waterisac.org/tlpclear-cisa-releases-update-to-its-malware-analysis-report-on-resurge-malware-associated-with-ivanti-connect-secure
• https://www.waterisac.org/tlpclear-cisa-releases-malware-analysis-report-on-malicious-listener-targeting-ivanti-endpoint-manager-mobile-systems
• https://www.waterisac.org/tlpclear-high-severity-vulnerabilities-patched-fortinet-and-ivanti-products-updated-june-26
• https://www.waterisac.org/tlpclear-critical-zero-day-vulnerabilities-fortinet-and-ivanti-impact-range-products-and
• https://www.waterisac.org/tlpclear-ivanti-connect-secure-vulnerability-actively-exploited-china-nexus-group-updated
• https://www.waterisac.org/tlpclear-cisa-releases-malware-analysis-report-resurge-malware-associated-ivanti-connect

Incident Reporting

WaterISAC encourages any members who have experienced malicious or suspicious activity to email an*****@*******ac.org, call 866-H2O-ISAC, or use the confidential online incident reporting form.

Related WaterISAC PIRs: 6, 7, 8, 12