Ivanti Connect Secure Zero‑Day CVE‑2026‑104935: What CISA Says to Do

What is affected #

CISA's alert on Ivanti says it is CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure aware of Ivanti's disclosure of this newly exploited vulnerability. The affected versions are listed in the table below, along with the fixed-version information the source provides.

The CISA alert also states that Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027. The sources do not give a specific fixed build number for each branch, so readers should take exact target versions from Ivanti's advisory, which the CISA alert links.

Protection steps #

CISA's guidance has two tracks: updating unaffected deployments and recovery steps for systems where compromise is suspected. The alert gives the following steps, in order of its presentation.

1. Immediately update affected Ivanti Connect Secure appliances and deployments to the latest version, as outlined in Ivanti's security advisory.
2. Review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide for detailed patching guidance for hardware and virtual appliance deployments.
3. If compromise is suspected, create a backup of the appliance configuration, following Ivanti's archiving server documentation.
4. Conduct a factory reset and upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
5. Restore the appliance configuration from the backup created in step 3.
6. Reset passwords for all accounts, including domain, administrator, and local accounts.
7. Revoke and reissue stored certificates, and reset stored API keys and license server credentials.

The alert also recommends reviewing the Volexity blog titled "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days," which is named in the CISA alert but was not provided as a linked source for this article.

How to check whether you are affected #

The first check is version inventory. Compare each appliance and virtual deployment against the affected versions listed by CISA: 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Any deployment in those ranges falls under the CISA guidance to update immediately.

The second check concerns possible past exploitation, which CISA describes as harder. The alert states that organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation. It also warns that Ivanti's Integrity Checker Tool may not detect evidence of exploitation of this CVE, because threat actor commands execute in memory. A clean result from that tool therefore does not, according to the CISA alert, rule out compromise.

Organizations should also reset credentials and keys as part of recovery, because the alert lists account passwords, certificates, API keys, and license server credentials among the items to reset or reissue if compromise is suspected.

Where this fits in CISA's KEV process #

CISA's CISA Adds Two Known Exploited Vulnerabilities to Catalog alert, also dated October 13, 2026, lists CVE-2026-104935 alongside CVE-2026-96951, a Microsoft Windows Command Injection Vulnerability. Both were added based on evidence of active exploitation.

That alert also describes Binding Operational Directive (BOD) 26-04. It applies to Federal Civilian Executive Branch (FCEB) agencies and requires them to prioritize rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. It also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied. The alert states that CISA encourages all organizations, not only FCEB agencies, to adopt risk-based vulnerability management and to prioritize KEV remediation.

The alert describes the criteria for KEV submissions as a CVE ID, evidence of exploitation, and clear mitigation guidance. Readers who know of an exploited vulnerability not yet in the catalog can submit it through CISA's KEV Nomination Form, which the alert links.