CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

Attackers exploited a high-severity authentication-bypass flaw in Ivanti Connect Secure, or ICS, appliances. The vulnerability lets remote attackers without accounts run arbitrary commands. CISA urged immediate action because exploitation was already occurring, not merely being discussed as a theoretical risk.

Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 to fix the issue. Volexity said threat actor UTA0576 chained the flaw with remote code execution and privilege escalation vulnerabilities. That chain produced unauthenticated root-level code execution and enabled credential-focused post-exploitation activity.

CISA added the vulnerability to its actively exploited list and ordered federal civilian agencies to secure networks by Friday under BOD 26-04. It also urged all defenders to patch, investigate for compromise, and perform network and memory forensics. If compromise is confirmed, CISA recommends resetting the appliance, rebuilding or upgrading it, restoring configuration, and rotating credentials, certificates, and keys.

A zero-day is a security flaw being exploited before defenders have had a patch or enough warning to protect systems. An authentication bypass is a weakness that lets an attacker get past a system’s normal identity check. CVE-2026-104935 is especially serious because it affects an internet-facing remote-access appliance.

According to the article, the flaw allows remote threat actors without privileges to execute arbitrary commands. The attacks are low complexity and require no user interaction. Volexity said attackers combined this authentication bypass with a remote code execution flaw and a privilege escalation flaw, creating unauthenticated root-level code execution on targeted ICS systems.

Ivanti released fixed versions after warning of limited exploitation in the wild. CISA described ongoing exploitation involving credential theft and data exfiltration. The article does not disclose the precise technical request or code path used to bypass authentication, so the mechanism can be explained only at this level from the available reporting.

The exposure is substantial: Shadowserver tracks more than 5,600 internet-exposed hosts with Ivanti Connect Secure fingerprints. That figure does not show how many systems are vulnerable, patched, compromised, or honeypots. The article specifically warns that some hosts may be designed to attract and observe malicious activity.

Defused found evidence that attackers were abusing CVE-2026-104935 in the wild on October 1st. CISA said exploitation had occurred since at least October 1st, while Volexity reported seeing UTA0576 chain the flaw with other vulnerabilities since at least October 3rd. Ivanti later released fixed ICS versions and urged customers to act immediately.

The timeline shows a gap between exploitation and public remediation. Administrators therefore cannot treat the patch date as the start of the threat. They must review earlier logs and conduct network and memory forensics, because some malicious commands may have run only in memory and left limited evidence.

The attack could move beyond the Ivanti appliance. CISA warned that exploitation was used for credential theft and data exfiltration. Volexity observed post-exploitation actions aimed at Active Directory credentials and secrets, including Local Administrator Password Solution, or LAPS, passwords, and BitLocker recovery keys.

The exploit chain explains how this became possible. An authentication bypass opened access without valid credentials. A remote code execution flaw let the attacker run code, and privilege escalation produced unauthenticated root-level execution. From that position, the attacker could search the appliance and connected environment for stored secrets and valuable administrative information.

Active Directory credentials can support access to accounts and systems across an organization. LAPS passwords protect local administrator accounts, so their theft can provide powerful local access. BitLocker recovery keys can help recover data from encrypted devices. The article confirms targeting and theft activity, but does not state exactly which systems or data were ultimately exfiltrated.

Patching stops future exploitation of the known flaw, but it does not undo an attacker’s earlier access. CISA warned that Ivanti’s Integrity Checker Tool may miss evidence of CVE-2026-104935 exploitation because threat actor commands can execute in memory. A normal integrity check may therefore produce insufficient evidence of what happened.

CISA says organizations investigating possible compromise should conduct network and memory forensics. If an appliance is compromised, defenders should back up its configuration, perform a factory reset, and upgrade it. Cloud and virtual systems should instead be rebuilt and upgraded before configuration is restored.

Recovery must also address secrets that may already have been exposed. CISA recommends resetting domain, administrator, and local account passwords. Organizations should revoke and reissue stored certificates, reset API keys, and reset license server credentials. These steps reduce the chance that attackers can return using stolen access, even after the appliance is patched.

Ivanti is the vendor responsible for Connect Secure and released four ICS versions to address CVE-2026-104935. It warned customers to act immediately because of limited exploitation in the wild. CISA added the flaw to its actively exploited list, set a deadline for federal civilian agencies, and advised all defenders to patch and investigate.

Volexity provided the clearest attack details. It attributed activity to an unknown actor called UTA0576 and described a chain combining authentication bypass, remote code execution, and privilege escalation. Defused independently confirmed evidence of exploitation beginning October 1st. These reports helped establish that the issue was being actively abused.

Shadowserver has a different role. It tracks internet-exposed hosts displaying ICS fingerprints and reported more than 5,600. That count shows potential exposure, but not which systems are protected or compromised. Together, the organizations supplied remediation, threat intelligence, confirmation, and visibility into the affected internet population.

Remote-access appliances are valuable targets because they provide access to services used to connect into organizational networks. Ivanti Connect Secure systems are exposed to the internet, so attackers can target them remotely rather than first compromising an internal device. The article also shows that these appliances may contain or provide access to credentials and other secrets.

The exploit chain had three stages. Authentication bypass allowed entry without valid credentials. Remote code execution let the attacker run commands on the appliance. Privilege escalation raised the attacker’s permissions to root level, producing unauthenticated root-level code execution. Volexity then observed efforts to target Active Directory credentials, LAPS passwords, and BitLocker recovery keys.

This combination makes a single appliance compromise potentially broader than one device. Stolen credentials can support access elsewhere, while recovery keys can expose protected data. The article reports more than 5,600 exposed hosts and repeated Ivanti zero-day exploitation, so defenders should patch quickly and investigate historical activity, not only current device status.