The Cybersecurity and Infrastructure Security Agency (CISA) has issued an important alert regarding a critical vulnerability affecting Ivanti Connect Secure, identified as CVE-2026-104935. This zero-day vulnerability impacts multiple versions of the software, including 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Cyber threat actors are actively exploiting this security flaw, which permits unauthenticated remote execution of arbitrary commands. Such exploits can lead to credential theft and data exfiltration, posing significant risks to affected organizations.

CISA urges organizations using vulnerable Ivanti Connect Secure appliances to immediately update to the latest version, as specified in Ivanti's security advisory. Additionally, the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide provides detailed instructions for updating both hardware and virtual appliance deployments. It is important to note that support for Ivanti Connect Secure version 22.8 will end on January 31, 2027.

Organizations concerned about potential compromises should carry out network and memory forensic investigations to detect signs of exploitation. However, Ivanti’s Integrity Checker Tool may not identify all evidence of CVE-2026-104935 exploitation, as malicious commands are executed in memory.

CISA advises reviewing Ivanti's security advisory and implementation guide and applying all necessary updates without delay. For additional insights, organizations can consult the Volexity blog post titled 'A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days'.

The information provided by CISA is intended solely for informational purposes and does not imply endorsement of any commercial entities, products, or services mentioned within this report.