Ivanti Connect Secure zero-day: patching is not the cleanup

Ivanti Connect Secure has another exploited zero-day. CVE-2026-104935 is an authentication bypass in the VPN appliance that lets an unauthenticated attacker run commands on the box. Attackers used it before Ivanti published a fix on October 13. CISA's advice goes past "update now": the vendor's own integrity checker may not see the compromise, so a clean scan does not mean a clean box.

What actually happened

CISA's alert says threat actors are exploiting the bug for credential theft and data exfiltration. CISA added it to the Known Exploited Vulnerabilities catalog the same day Ivanti disclosed it.

Rapid7 puts it at CVSS 8.6, an authentication bypass by spoofing (CWE-290). Affected and fixed versions:

• 25.1.1.1 and earlier → fixed in 25.1.1.2
• 25.1.2.2 and earlier → fixed in 25.1.3.0 or 25.1.3.1
• 22.8R2.4 and earlier → fixed in 22.8R2.5
• 22.7 and older are not affected

Volexity found the activity in early October. It reports that the attacker chained this bug with a privilege escalation flaw that is not patched yet. Ivanti plans to fix that one later.

The detection problem is the real story. CISA says Ivanti's Integrity Checker Tool may miss this activity because the attacker's commands run in memory. CISA recommends network and memory forensics. If you suspect a compromise, its recovery steps are: back up the config, factory reset (or rebuild a virtual instance), upgrade, restore the config, then reset every password, including domain, admin and local accounts. Revoke and reissue stored certificates. Rotate stored API keys and license server credentials.

Also note: the 22.8 branch reaches end of life on January 31, 2027.

Why it matters for your business

A VPN appliance is a key ring. It holds directory credentials, certificates and service accounts, so an attacker on the box gets all of them. Patching closes the door. It does not take back the keys already copied.

So treat an internet-facing Ivanti box that ran a vulnerable build this month as possibly compromised. Patch today. Then decide, on purpose, whether you have the forensic evidence to call it clean. Most small teams do not. If you don't, follow CISA's reset-and-rotate list. A weekend of password resets costs less than an attacker who keeps your domain admin credentials after the patch.

And with one privilege escalation still open, check the vendor advisory again next week.

Sources: CISA, Rapid7.