CISA flags active CVE-2026-104935 in Ivanti

CISA said threat actors are actively exploiting CVE-2026-104935 in Ivanti Connect Secure. The flaw allows arbitrary commands to be run remotely without authentication, and it has already been used for credential theft and data exfiltration. The agency added it to its Known Exploited Vulnerabilities catalog on October 13, 2026.

What did Ivanti say about the flaw?

Ivanti released fixes for ICS 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, and said the 22.7R2.14 branch or earlier is not affected, according to its advisory. The vendor rated the vulnerability CVSS 8.6, which is high, and described it as an authentication bypass through spoofing.

Ivanti also said known exploitation was limited at the time of disclosure. As response steps, it recommended updating, running its Integrity Checker Tool regularly, and reviewing the indicators of compromise published by Volexity.

What did the technical analysis show?

Volexity's analysis reconstructed an attack chain that combined authentication bypass, file writing, and remote code execution. After that first stage, a separate privilege escalation led to root access, according to the cited report.

iTnews also said a compromised appliance was running ICS 22.8R2.4, which appeared fully updated at the time of compromise, and attributed the case to the actor UTA0576. The Center for Internet Security published an independent advisory confirming the exploitation reported by Ivanti and listing 25.1.1.1 or earlier, 25.1.2.2 or earlier, and 22.8R2.4 or earlier as affected versions.

Which versions remain under review?

The affected versions vary depending on the advisory consulted, but all refer to specific Ivanti Connect Secure branches and systems already in production. CISA relied on active exploitation to add the CVE to its known vulnerabilities list, while Ivanti limited the known scope in its initial statement.

CyberScoop reported, without independent confirmation in the material provided, that Ivanti may have first identified part of the vulnerability during internal checks in June.