Ivanti Connect Secure vulnerability: CISA urges immediate patch

CISA is urging organizations to update Ivanti Connect Secure appliances immediately after disclosure of an actively exploited authentication bypass, tracked as CVE-2026-104935. The vulnerability allows unauthenticated, remote execution of arbitrary commands on affected Ivanti Connect Secure versions, and the agency added the issue to its Known Exploited Vulnerabilities catalog, calling for urgent action.

What happened and who reported it

The U.S. Cybersecurity and Infrastructure Security Agency alerted organizations after Ivanti disclosed the flaw, which impacts several Ivanti Connect Secure releases, according to CISA. The agency says threat actors are exploiting the weakness to steal credentials and exfiltrate data, and added the vulnerability to its KEV catalog. The Hacker News reported that the KEV listing triggers a Federal Civilian Executive Branch requirement to apply fixes by October 16, 2026.

Both CISA and reporting outlets recommend following Ivanti’s published upgrade and recovery guidance. CISA specifically points organizations to Ivanti’s security advisory and the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for patching instructions.

How attackers are using the vulnerability

Security firms and researchers have observed active testing and exploitation. Previdian told The Hacker News its honeypots logged 105 exploitation attempts from 50 unique IP addresses geolocated to Singapore and the U.S., and published several observed IPs. The Hacker News described how those probes used a crafted header to reach an internal CGI handler, uploading Perl scripts disguised as ZIP files to test for code execution.

Volexity reported earlier exploitation attempts dating back to October 3, 2026, and described a previously undocumented actor it calls UTA0576. Volexity said that actor chained this authentication bypass with a privilege escalation issue to achieve unauthenticated root-level execution. Post-exploitation activity reported by Volexity included extracting credentials from the appliance, pulling limited Active Directory metadata, deploying Kerberos tools for credential testing, LDAP packet capture, host reconnaissance, and dropping tools to search for administrator passwords and BitLocker recovery keys. Researchers also noted efforts to hide activity by modifying or removing logs and temporary artifacts, according to The Hacker News summary of Volexity’s findings.

Ivanti Connect Secure vulnerability: immediate steps

If you run affected Ivanti Connect Secure appliances, CISA and Ivanti recommend the following actions:

• Update the appliance to the latest Ivanti Connect Secure version, following Ivanti’s Security Advisory and the 25.x Upgrade and Migration Compatibility Guide.
• If you suspect compromise, perform network and memory forensics to look for evidence of exploitation, since CISA warns that Ivanti’s Integrity Checker may not find activity that executes only in memory.
• Back up your appliance configuration, perform a factory reset, and then upgrade to the latest version before restoring configuration from the backup.
• For cloud or virtual appliances, rebuild the virtual instance and upgrade to the current version before restoring configuration.
• After recovery, reset all passwords for domain, administrator, and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.

Follow Ivanti’s recovery procedures as referenced by CISA and review vendor documentation carefully before applying updates. Want to know how exposed your own site is? Start with a free external scan.

If you find signs of compromise

CISA and reporting researchers describe specific post-exploitation activities you should look for when investigating: credential theft from the appliance, unusual Active Directory queries or metadata exports, Kerberos-related tools or traffic, LDAP captures, and unexpected binaries or scripts placed on the system. Because some attacker commands run only in memory, reliable detection will often require both network capture analysis and memory forensics.

If you confirm a compromise, follow the recovery checklist above: rebuild or reset the appliance, upgrade to the current software release, restore from a known-good backup, and rotate credentials and certificates. Document the timeline and evidence you collect to support further investigation or reporting.

What small organizations and nonprofits should take away

This is a single-vendor VPN appliance vulnerability, but it matters to any organization that uses Ivanti Connect Secure for remote access. CISA’s KEV listing makes the issue mandatory for Federal Civilian Executive Branch systems, and observed activity shows attackers are actively probing and chaining this bug with privilege escalation for deeper control. If you do not run Ivanti Connect Secure, treat this as a reminder to confirm remote-access appliances and VPN gateways in your environment are patched and that you can rebuild and recover them quickly if needed.

For the full agency alert see CISA’s advisory and for investigative details and researcher observations see reporting from The Hacker News.