[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNg8tzva_BjpgPv0ktUcLz0ih_Z6A4qSatSiKNNjryLc":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":35},"a038a2db-7d9d-4fdc-8c93-31646478b09a","CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure","cisa-urges-patching-newly-exploited-vulnerability-in-ivanti-connect-secure-0b5b8a","CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026. CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Ivanti Connect Secure (CVE-2026-104935). Organizations should also review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027. Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. Note: Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory. If your organization suspects a compromise, CISA recommends implementing the following actions from Ivanti Connect Secure Recovery Procedures: Create a backup of the appliance configuration. Review Ivanti’s How to Backup & Restore the Binary Configuration Using Archiving Server for more information. Conduct a factory reset and upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version. Restore the appliance configuration from the backup created in step 1. Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials. CISA urges organizations to review the Ivanti security advisory and guide noted above and apply necessary updates. CISA also recommends reviewing the Volexity blog, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days. Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.","CISA has identified a critical zero-day vulnerability, CVE-2026-104935, in Ivanti Connect Secure that is being actively exploited by threat actors for credential theft and data exfiltration. The vulnerability allows for remote, unauthenticated command execution. CISA has added it to its Known Exploited Vulnerabilities catalog and urges immediate patching and potential forensic investigation for compromised systems.","CISA urges patching Ivanti Connect Secure after zero-day vulnerability exploitation.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F13\u002Fcisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure",null,"2026-10-13T12:00:00+00:00","2026-10-13T22:00:15.688331+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"cyber threat actors","threat_actor",{"name":27,"type":28},"zero-day","technology",{"name":30,"type":19},"Ivanti Integrity Checker Tool","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":12,"name":33,"slug":34},"Vulnerabilities","vulnerabilities",[36,40,45,47],{"category":37},{"id":38,"icon":12,"name":39,"slug":27},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":31,"icon":12,"name":33,"slug":34},{"category":48},{"id":49,"icon":12,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"cve","CVE-2026-104935","Newly exploited zero-day vulnerability in Ivanti Connect Secure.",[21,18,30],{"controls":59,"vendors":145},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":90,"name":91,"problem":92,"products":93},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":119,"name":120,"problem":121,"products":122},"patch-management","Automated patch management","Known holes get closed in days, not months.",[123,130,137],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":119,"product_name":127,"url":128,"description":129},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":131,"vendor_name":21,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[146],{"slug":131,"name":21,"logo_path":132,"roles":147},[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"critical-ivanti-zero-day-exploited-for-credential-theft-and-remote-code-execution","Critical Ivanti Zero-Day Exploited for Credential Theft and Remote Code Execution","A critical zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited, allowing unauthenticated remote command execution — one of the most severe risk profiles possible for an internet-facing appliance. Because no authentication is required, threat actors can compromise systems at scale before defenders even become aware of the exposure. The fact that CISA added this to its Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation, making delayed patching an unacceptable risk. Organizations relying on Ivanti Connect Secure for VPN or remote access are particularly exposed, as compromise of these systems can serve as a foothold into the broader enterprise network.",[154,155,156,157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST IR-4: Incident Handling","NIST RA-5: Vulnerability Monitoring and Scanning","CISA Known Exploited Vulnerabilities (KEV) Catalog","ITIL Change Management: Emergency Change Procedures","NIST AC-17: Remote Access Controls",{}]