The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability.

The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior that could allow a remote unauthenticated attacker to execute arbitrary commands.

"CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration," the agency said.

The agency has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 16, 2026.

CISA is also recommending that customers of affected ICS deployments review Ivanti's Connect Secure Upgrade and Migration Compatibility Guide for patching guidance, cautioning that version 22.8 reaches end-of-life on January 31, 2027.

"Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation," it added.

In the event a compromise is detected, CISA is advising organizations to implement the following actions -

The development comes as Previdian disclosed that it has observed 105 exploitation attempts targeting its honeypot sensors as of October 14, 2026. S.

Source link