CISA orders urgent patching of Ivanti vulnerability under active zero-day attack

The vulnerability, tracked as CVE-2026-104935, allows remote attackers to execute arbitrary commands on vulnerable ICS systems without authentication. Ivanti described the attacks as low-complexity and requiring no user interaction.

Ivanti released versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address the flaw. The company warned customers of “limited exploitation in the wild” but did not provide details about ongoing attacks.

Cybersecurity firm Volexity reported that a threat actor it tracks as UTA0576 has been chaining this authentication bypass with a remote code execution (RCE) and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass are both tracked under the same CVE. Volexity said the actor targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.

Threat intelligence firm Defused corroborated the exploitation, saying evidence of attacks abusing CVE-2026-104935 first appeared on October 1.

Internet threat monitoring group Shadowserver tracks over 5,600 Internet-exposed hosts with ICS fingerprints, though it is unclear how many are patched or are honeypots.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on Tuesday. Under Binding Operational Directive 26-04, federal civilian agencies must remediate by Friday. CISA also issued a public advisory urging all organisations to patch immediately and check for signs of compromise.

Analysis

Why This Matters

Organisations using Ivanti Connect Secure face a serious risk of complete compromise, with attackers able to steal domain credentials and encryption keys without any user interaction.
The CISA deadline for federal agencies highlights the urgency, but the wider private sector is also vulnerable, especially given the large number of exposed ICS hosts.
Past Ivanti zero-days have led to widespread intrusions; this vulnerability could similarly affect critical infrastructure and enterprise networks.

Background

Ivanti Connect Secure (formerly Pulse Secure) is a widely used VPN and network access solution deployed by government agencies and large enterprises. The product has been targeted in multiple zero-day attacks in recent years, including a series of vulnerabilities disclosed in early 2024 that were exploited by state-sponsored groups. Vendors such as CISA and Ivanti have frequently urged rapid patching as exploitation often begins before public disclosure.

Key Perspectives

CISA: Emphasises immediate action to reduce risk across the federal enterprise and the broader internet, using its directive to mandate fixes within days. Ivanti: Has released patches and publicly warned customers, but faces ongoing scrutiny over the frequency of critical vulnerabilities in its products. Volexity and Defused: Provide technical details of the exploit chain and post-exploitation activity, helping defenders detect compromise. Their reporting confirms active, targeted attacks. System administrators: Tasked with applying patches on critical network infrastructure quickly, often under pressure to avoid downtime.

What to Watch

Uptake of the patch across the more than 5,600 exposed ICS hosts; a slow patch rate would indicate continued risk.
Additional technical reports from Volexity or others detailing campaign attribution or further indicators of compromise.
CISA's next deadline for federal compliance and any broader guidance for non-federal entities.

Analysis

Why This Matters

Background

Key Perspectives

What to Watch

Sources