CISA orders patch for Ivanti Connect Secure zero‑day after Oct 1 exploitation

On October 13, 2026, CISA issued an emergency directive telling administrators to patch an actively exploited zero‑day in Ivanti Connect Secure tracked as CVE‑2026‑104935.

Ivanti published a security advisory for CVE‑2026‑104935 on the same day, confirming the flaw and urging immediate patching. The vulnerability carries a CVSS v3.0 score of 8.6 and is classified as CWE‑290 authentication bypass by spoofing. Ivanti Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are affected. Versions 22.7R2.14 and earlier are not affected.

Fixed versions include 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Ivanti stated that part of the vulnerability was initially discovered through its internal product security program and patched in the July 2026 release 25.1.3.0. While the vendor worked to backport the fix to other supported versions, exploitation was occurring. The earliest observed exploitation of the attack chain was on October 1, 2026, roughly two weeks before Ivanti’s public disclosure and CISA’s alert.

Volexity reported that attackers chained three separate Ivanti Connect Secure zero‑day flaws to gain root access. Two of the flaws are addressed by CVE‑2026‑104935: an authentication bypass and a remote code execution that allow execution as the cgi‑server user. A third, still‑unpatched privilege‑escalation flaw elevates that access to root. CISA added CVE‑2026‑104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026.

CISA issued a binding operational directive for federal civilian agencies with a compressed remediation window, reportedly requiring action by October 16, 2026. According to CISA’s alert and Ivanti’s advisory, threat actors exploiting the flaw are using the access for credential theft and data exfiltration, not merely as a foothold. For defenders, CISA and Ivanti recommend assuming compromise if an appliance was internet‑facing and unpatched during the exploitation window. They advise rotating credentials that may have transited the device.

Defenders should preserve forensic images before reboot. They recommend hunting for unauthorized commands and persistence mechanisms rather than only verifying that a patch applied cleanly. Ivanti’s Integrity Checker Tool, intended to detect filesystem tampering, may miss this particular attack chain because the exploit modifies library code only in memory and restores altered configuration data. Volexity advised that compromise confirmation requires forensic investigation, including network and memory analysis.

Volexity tracks the observed activity as UTA0576 but assesses low confidence that the motive is criminal rather than espionage. No definitive threat‑actor attribution has been made public. The pattern of repeatedly exploited edge appliances (Ivanti Connect Secure and Citrix NetScaler) reflects a broader trend where attackers target internet‑facing, high‑privilege devices that are difficult to patch without disrupting remote access, leading to recurring zero‑day incidents. Volexity’s detailed analysis of a single compromised appliance showed indicators such as repeated requests to /dana‑na/auth/url_default/welcome.cgi.

Anomalous X‑DSCGI‑PATH headers were observed. Presence of a /data/.icscap/ directory was noted. The attacker IP address was 108.165.147.64. Activities included LDAP credential theft, Active Directory password searches, and password‑spraying attacks.