On October 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued a critical alert. CISA is aware of vulnerabilities in Ivanti Connect Secure versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 and earlier. These vulnerabilities, known as CVE-2026-104935, allow for remote unauthenticated execution of arbitrary commands. This flaw has already been exploited by threat actors for credible theft and data exfiltration.
CISA’s warning came alongside a dark reading report from October 14, which details the vulnerabilities and highlights the importance of timely patching. The report emphasizes that while the patch was released July 2026 as part of Ivanti’s routine updates, some versions were still insecure due to partial deployment issues.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert on October 13, 2026, about a critical vulnerability in Ivanti Connect Secure. The vulnerability, designated CVE-2026-104935, affects versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior of Ivanti Connect Secure. This zero-day vulnerability allows for remote, unauthenticated execution of arbitrary commands. The flaw enables attackers to steal credentials and exfiltrate data. Since at least October 1, 2026, cyber threat actors have actively exploited this zero-day flaw in real-world attacks.
CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog, a move to highlight the severity of the issue and the urgent need for patching these vulnerabilities in Ivanti Connect Secure. Ivanti initially only partially disclosured and patched the vulnerability in July 2026.
Ivanti urges immediate action to update systems with the latest fixes outlined in its Security Advisory Ivanti Connect Secure. Other critical vulnerabilities in Cisco’s Secure Email Gateway and Palo Alto Networks’ PAN-OS also have patches available.
The advisory states that both federal agencies and private entities must prioritize applying these fixes due to the critical nature of these vulnerabilities
Why it matters
The Ivanti vulnerability, currently exploited without authorization, highlights a serious threat to businesses and IT teams. This could have significant consequences by enabling unauthorized access into remote systems, including the extraction of confidential data. This critical vulnerability affects older Ivanti versions, making immediate patching mandatory. If left unaddressed, attackers could execute arbitrary commands and steal credentials. It underscores the importance of regular vulnerability management and prompt patch deployment. In this case, the risk is particularly high due to the nature of the authentication bypass vulnerability. Organizations using Ivanti Connect Secure are advised to prioritize updating their systems to mitigate vulnerabilities. The issue was partially addressed in July 2026 by Ivanti, but threat actors have leveraged the incomplete fix to exploit the vulnerability according to Dark Reading. The addition of this vulnerability to CISA’s Known Exploited Vulnerabilities Catalog should act as a prompt for immediate action for government agencies and private organizations within the US. The inclusion in this catalog emphasizes that not patching immediately puts critical infrastructure at risk according to CISA News. CISA recommends organizations review the Ivanti Security Advisory and update to the latest version to stay secure. Organizations should focus on their ability to handle critical patches and vulnerabilities. The Ivanti Connect Secure vulnerability is not an isolated case. Recent events show an increasing trend of zero-day vulnerabilities being exploited. For instance, Cisco recently patched a similar zero-day flaw in its Secure Email Gateway. These trends point to a growing need for robust patch management practices and continuous monitoring. Organizations need to ensure their teams are equipped with the knowledge and tools to handle these critical patches promptly. The operational impact includes potential downtime, loss of sensitive data, and disruption of services. Therefore, it is essential for IT teams to stay vigilant and proactive in managing security updates.What to do
- **Identify Affected Systems**: Update Ivanti Connect Secure to the latest version. CISA warns about active exploitation of the critical vulnerability.
- **Prioritize Patch Deployment**: CISA advises organizations to prioritize the patching for any Ivanti appliances, especially those operating in external-facing environments. The vulnerability enables threat actors to conduct credential theft and data exfiltration.
- **Review Ivanti’s Security Advisory**: Ivanti discloses vulnerabilities in Ivanti Connect Secure.
- **Evaluate Other Infrastructure**: In a proactive step, assess any other Ivanti products deployed, as related vulnerabilities are possible. CISA adds four new vulnerabilities to its KEV Catalog based on evidence of active exploitation, according to Dark Reading.
- **Implement Stronger Security**: CISA adds four new vulnerabilities to its KEV Catalog, reinforcing vulnerability management requirements. Binding Operational Directive (BOD) 26-04 outlines the need for prompt security updates (CISA News 2026).
2TI lens
For organizations grappling with vulnerability management, this incident underscores the need for proactive patch management. Ivanti's case highlights the risks of delayed fixes. At 2TI, a holistic approach to patching can mirror the comprehensive measures of a Spatial Digital Agency. This involves an integrated ecosystem that ensures continuous monitoring and quick updates, thus minimizing gaps and reducing the window for attack.
Sources
CISA described how Ivanti disclosed the vulnerability CVE-2026-104935, and CISA's urgency in fixing the zero-day vulnerability Ivanti Connect Secure.
CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on the 13th of October, 2026.
The zero-day allowed remote unauthenticated attacks to execute arbitrary commands.
Ivanti reported the flaw was partially patched earlier in July.
Bleeping Computer detailed how CISA urged the public about zero-day attacks that began on Oct 1st.
Cisco patched an actively exploited zero-day in their Secure Email Gateway.
- CISA News
- Dark Reading
- BleepingComputer