The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent call to organizations to promptly update their Ivanti Connect Secure appliances. This directive comes after a critical vulnerability, identified as CVE-2026-104935, was found to be actively exploited. The flaw, affecting ICS versions 25.1.1.1 and earlier, allows for authentication bypass, enabling unauthorized remote command execution.
Vulnerability Threats and CISA’s Immediate Actions
As cyber threat actors exploit this zero-day vulnerability, CISA has highlighted its potential for unauthorized command execution, leading to credential theft and data exfiltration. Consequently, this security flaw has been incorporated into CISA’s Known Exploited Vulnerabilities list, mandating that Federal Civilian Executive Branch agencies apply necessary patches by October 16, 2026.
CISA advises users of affected ICS systems to consult Ivanti’s Connect Secure Upgrade and Migration Compatibility Guide for proper patching procedures. Additionally, version 22.8 of the software will reach its end-of-life on January 31, 2027, urging users to transition to newer versions promptly.
Steps for Identifying and Mitigating Compromises
Organizations suspecting a breach are recommended to perform thorough network and memory forensic analyses to detect any exploitation evidence. In case of confirmed compromise, CISA suggests several remedial actions. These include backing up appliance configurations, performing a factory reset, upgrading to the latest software version, and resetting all account passwords. For cloud and virtual systems, rebuilding the virtual instance and upgrading to the latest version is advised.
Furthermore, organizations should revoke and reissue stored certificates, reset API keys, and update license server credentials to mitigate risks effectively.
Observed Exploitation Attempts and Future Implications
Previdian has reported observing 105 attempts to exploit the vulnerability through its honeypot sensors, with attackers originating from Singapore and the U.S. using the X-DSCGI-PATH header to breach internal CGI handlers. The attempts, primarily aimed at testing code execution, are anticipated to evolve into more severe exploits.
Volexity researchers have noted that a previously unidentified threat actor, UTA0576, has been exploiting this vulnerability since October 3, 2026. This group leverages the vulnerability alongside a privilege escalation flaw to achieve root-level code execution, driven by criminal rather than espionage motives.
Following successful breaches, further malicious activities include extracting credentials, exfiltrating Active Directory metadata, and deploying tools for credential testing and reconnaissance. The concealment of these actions through log modifications underscores the sophistication of the threat actor’s tactics.
In conclusion, as exploitation attempts continue to rise, swift action and adherence to CISA’s guidelines are paramount in safeguarding sensitive data and maintaining the integrity of affected systems.
