CISA has urged organisations to urgently update Ivanti Connect Secure (ICS) appliances to the latest version after the disclosure of a zero-day authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS 8.6). The flaw affects ICS versions 25.1.1[.]1 and earlier, 25.1.2[.]2 and earlier, and 22.8R2.4 and earlier, permitting remote unauthenticated command execution.
CISA notes that threat actors are exploiting the vulnerability to conduct credential theft and data exfiltration, and the agency has added the flaw to the Known Exploited Vulnerabilities (KEV) catalog, with Federal Civilian Executive Branch (FCEB) agencies required to patch by 16 October 2026. Ivanti’s Upgrade and Migration Compatibility Guide is recommended for patching guidance, and agencies are reminded that version 22.8 reaches end‑of‑life on 31 January 2027.
For organisations weighing whether they were compromised, CISA advises network and memory forensics to identify exploitation evidence, and, if a compromise is detected, to back up appliance configurations, perform a factory reset, upgrade to the latest version (rebuilding cloud/virtual instances as needed), restore configurations, and reset passwords, certificates, API keys and credentials.
The disclosure from Previdian reports 105 exploitation attempts targeting its honeypot sensors as of 14 October 2026, originating from 50 unique IPs geolocated to Singapore and the United States. Threat actors are observed using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files; the scripts return markers to indicate remote code execution success.
Volexity adds that CVE-2026-104935 was first exploited on 3 October 2026 by a group dubbed UTA0576, combining the bypass with a privilege escalation vulnerability to achieve unauthenticated root-level code execution, followed by credential theft, limited AD metadata exfiltration, Kerberos tooling deployment, host recon, LDAP traffic capture, and credential discovery efforts. The researchers note attempts to conceal activity through selective log modification and recovery of altered state.