Critical Ivanti Zero-Day Exploited for Credential Theft and Remote Code Execution
A critical zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited, allowing unauthenticated remote command execution — one of the most severe risk profiles possible for an internet-facing appliance. Because no authentication is required, threat actors can compromise systems at scale before defenders even become aware of the exposure. The fact that CISA added this to its Known Exploited Vulnerabilities (KEV) catalog signals confirmed, real-world exploitation, making delayed patching an unacceptable risk. Organizations relying on Ivanti Connect Secure for VPN or remote access are particularly exposed, as compromise of these systems can serve as a foothold into the broader enterprise network.
Tactical Insight
Immediate Actions
- Apply Ivanti's emergency patch or upgrade to the latest fixed version of Connect Secure without delay.
- Temporarily isolate or restrict internet-facing Ivanti Connect Secure appliances if patching cannot be completed immediately.
- Conduct forensic triage on all Ivanti Connect Secure instances to detect indicators of compromise (credential theft, unauthorized sessions, or lateral movement).
Long-Term Improvements
- Establish and enforce an emergency patching SLA (e.g., 24–48 hours) for critical vulnerabilities on internet-facing systems.
- Maintain a continuously updated inventory of all network appliances, including firmware versions, using an automated asset management solution.
- Implement network segmentation to ensure VPN gateways and remote access appliances cannot directly reach sensitive internal systems without additional authentication.
Detection Measures
- Subscribe to CISA's KEV catalog alerts and integrate them into your vulnerability management workflow for automatic prioritization.
- Deploy behavioral monitoring and anomaly detection on remote access infrastructure to identify unusual command execution or authentication patterns.
- Enable centralized logging for all Ivanti Connect Secure activity and route logs to a SIEM for real-time alerting on suspicious events.