The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding the active exploitation of a critical vulnerability in Ivanti Connect Secure (ICS), tracked as CVE-2026-104935. This flaw, which has a CVSS score of 8.6, allows remote unauthenticated attackers to execute arbitrary commands on affected systems, posing significant risks to organizations using versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
CISA’s alert comes after reports of cyber threat actors exploiting this zero-day vulnerability for credential theft and data exfiltration. The agency has added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch agencies apply necessary patches by October 16, 2026. Organizations using ICS are advised to consult Ivanti’s Upgrade and Migration Compatibility Guide for patching instructions, especially as version 22.8 will reach end-of-life on January 31, 2027.
Exploitation Attempts and Threat Actor Behavior
As of October 14, 2026, cybersecurity firm Previdian reported observing 105 exploitation attempts targeting its honeypot sensors, originating from 50 unique IP addresses located in Singapore and the U.S. The attempts involved using the X-DSCGI-PATH header to access an internal CGI handler and upload Perl scripts disguised as ZIP files. These scripts are designed to return markers indicating whether remote code execution has been successful.
Ryan Dewhurst, founder and CEO of Previdian, noted that while the current payloads appear to be testing for code execution rather than deploying malware, the potential for full weaponized exploitation is imminent. “We’re seeing coordinated attempts to exploit this Ivanti vulnerability,” Dewhurst stated, emphasizing the urgency for organizations to act.
Post-Exploitation Activities
In a separate analysis, Volexity reported that the exploitation of CVE-2026-104935 was first observed on October 3, 2026, by a previously undocumented threat actor identified as UTA0576. This actor has been leveraging the vulnerability alongside a privilege escalation flaw to achieve unauthenticated root-level code execution. Following successful exploitation, UTA0576 has engaged in extensive post-exploitation activities, including credential extraction from the ICS VPN appliance and limited Active Directory metadata exfiltration.
Volexity researchers highlighted that UTA0576 has not deployed malware or web shells but has instead re-exploited the device for command execution while tampering with logs to obscure its activities. This behavior underscores the sophistication of the threat actor, who has demonstrated a capacity for evading detection mechanisms.
Recommendations for Organizations
CISA has recommended that organizations take immediate action to mitigate the risks associated with this vulnerability. Key steps include:
- Creating a backup of the appliance configuration.
- Conducting a factory reset and upgrading the appliance to the latest version.
- For cloud and virtual systems, rebuilding the virtual instance and upgrading to the latest version.
- Restoring the appliance configuration from the backup.
- Resetting passwords for all accounts and revoking and reissuing stored certificates.
Organizations are also advised to conduct thorough network and memory forensics to identify any signs of exploitation. Given the simplicity of the vulnerability’s root cause, which involves a single specially crafted request, the potential for widespread exploitation is high. As Ivanti Connect Secure has been a frequent target for attackers, including ransomware groups, the urgency for immediate patching and investigation cannot be overstated.
For further details, refer to CISA’s official guidance on this vulnerability here.
