CISA is warning organizations to patch a newly exploited vulnerability in Ivanti Connect Secure VPN appliances. CVE-2026-104935 is an authentication bypass that allows remote, unauthenticated command execution, and attackers are already using it to steal credentials and exfiltrate data. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026. If your business relies on an Ivanti VPN for remote access, this post covers what happened, whether you are affected, and what to ask your IT team today.
This matters to small and mid-sized businesses in the US and Canada because Ivanti Connect Secure (formerly Pulse Secure) is one of the remote-access VPN appliances that lets staff connect to the office from anywhere. When the front door to your network has a flaw this severe, the discussion is not about whether to patch, it is about how fast.
What Is CVE-2026-104935?
CVE-2026-104935 is an authentication bypass vulnerability that, when chained with other flaws, gives an attacker remote code execution on the appliance without a login. CISA describes it as allowing "remote, unauthenticated execution of arbitrary commands" and says threat actors are using it to conduct credential theft and data exfiltration.
Key facts from CISA's October 13, 2026 alert and Ivanti's security advisory:
- Affected versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
- Severity: authentication bypass leading to unauthenticated remote command execution.
- KEV listing: CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, the same day it added a Windows flaw (CVE-2026-96951) from the October Patch Tuesday.
- End of life: Ivanti Connect Secure version 22.8 reaches end of life on January 31, 2027. Organizations still on that branch will soon stop receiving fixes.
Ivanti's October 2026 security update acknowledged "limited exploitation in the wild" and urged customers to "act immediately."
How Are Attackers Using This Flaw?
Security firm Volexity published detailed research on October 13, 2026, showing how attackers chained multiple vulnerabilities to compromise fully patched appliances. Volexity's analysis found that a threat actor it tracks as UTA0576 had been exploiting the flaws since at least October 3, 2026, against ICS version 22.8R2.4, which was the latest available at the time.
According to Volexity, the attack chain combines three vulnerabilities:
- Authentication bypass: lets requests reach protected internal functions without a login.
- Remote code execution: lets the attacker run commands on the appliance.
- Privilege escalation: elevates access to root. A fix for this third flaw is expected in a future release.
The authentication bypass and remote code execution components are both tracked under CVE-2026-104935. Volexity reported that UTA0576 used this access to steal Active Directory credentials, including LAPS (Local Administrator Password Solution) passwords and BitLocker recovery keys. The threat actor also ran password-spraying attacks and exfiltrated configuration data from the VPN appliance.
Why Does the Integrity Checker Not Catch This?
CISA explicitly warns that Ivanti's Integrity Checker Tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory." Volexity's research confirms this. The exploit chain patches code in memory only and restores configuration data after each command, leaving no changes on disk for the tool to find.
This is not a flaw in the Integrity Checker. It is a limitation of any file-based detection when the attacker never writes a file. Volexity noted that UTA0576 also deleted evidence from Ivanti debug logs and Linux audit logs as part of its cleanup. Forensic investigation, including network and memory analysis, is required to identify whether a device was compromised.
If your team ran the Integrity Checker last week and it came back clean, that result does not prove the appliance was never compromised.
Who Is at Risk?
Any organization running Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, or 22.8R2.4 and prior. That includes businesses across Canada and the United States that use ICS as their remote-access VPN. The appliance sits on the public internet by design, so it is reachable by anyone, anywhere.
Volexity assessed with low confidence that UTA0576's motivation was criminal rather than espionage, based on the target of the activity. Attribution to any specific group remains uncertain. What is certain is that the exploit is now public knowledge, which typically accelerates attempts by other actors. As we noted in our analysis of the SonicWall SMA1000 flaw last week, remote-access appliances are a favorite target because they are exposed by design and often hold keys to the rest of the network.
What Should You Do If You Run Ivanti Connect Secure?
Patch immediately. CISA's guidance links to Ivanti's upgrade instructions for both hardware and virtual deployments. If you cannot patch today, consider taking the appliance offline until you can.
If you suspect compromise, CISA recommends these recovery steps, drawn from Ivanti's recovery procedures:
- Back up your configuration. Ivanti documents how to export the binary configuration to an archiving server.
- Factory reset or rebuild. For hardware appliances, perform a factory reset. For cloud and virtual systems, rebuild the virtual instance.
- Upgrade to the latest version. Install the patched release before putting the appliance back in service.
- Restore your configuration from the backup.
- Reset all credentials. Reset passwords for all accounts, including domain, administrator and local accounts. Revoke and reissue any stored certificates. Reset any stored API keys and license server credentials.
The credential reset is essential. If an attacker extracted passwords or keys before you patched, those credentials are still valid until you change them. The FBI's missed-patch breach, which the bureau blamed on a contractor failing to install a fix, is a reminder that patching alone does not undo what attackers did while the hole was open.
What Should SMB Leaders Ask Their IT Provider?
If someone else manages your network, these are the questions to ask this week:
- Do we run Ivanti Connect Secure (or Pulse Secure) for remote access? If yes, which version, and has the October 13 patch been applied?
- Has the Integrity Checker been run, and do you understand its limitations for this flaw? A clean result is not proof of no compromise.
- If we patched after October 3, are we treating this as a potential compromise? CISA and Volexity recommend forensic review when compromise cannot be ruled out.
- Have we reset credentials as CISA recommends? That includes domain accounts, certificates and API keys, not just local appliance passwords.
- What is the plan for appliances still on version 22.8, which reaches end of life in January 2027?
For a framework on how fast patches should land and what proof to expect from your IT provider, see our guide on setting a patch SLA. In the US, CISA's BOD 26-04 requires federal agencies to patch known exploited vulnerabilities within days, not weeks. That directive does not bind private businesses, but it is a useful benchmark. In Canada, the Canadian Centre for Cyber Security's baseline controls list patching as a core control, with similar urgency for flaws already being used in attacks.
The Pattern With Remote-Access Appliances
This is the second critical remote-access VPN flaw in a week. On October 6, SonicWall patched CVE-2026-102255, a 10.0-rated flaw in the SMA1000, and by October 9 honeypots were seeing exploitation attempts. That flaw also required no login. Remote-access appliances, whether Ivanti, SonicWall, Fortinet or another vendor, share the same exposure: they sit on the open internet so staff can connect from anywhere, and attackers check them first.
Our analysis of the FortiBleed campaign in June made the same point. In that case, configuration backups exposed credentials tied to tens of thousands of Fortinet devices. Different vendor, different flaw, same lesson: the box that lets your team work remotely is also the box attackers probe first.
The October 2026 Patch Tuesday, released the same day as the Ivanti disclosure, added a Windows flaw (CVE-2026-96951) to the KEV catalog. When multiple exploited flaws land in the same week, prioritization matters. For most small businesses, the VPN appliance comes first because it faces the internet.
The Lasting Lesson
The Integrity Checker is not enough. A clean scan does not prove no compromise. When an attacker executes commands in memory and cleans up after themselves, file-based tools see nothing. That means treating remote-access appliances as high-risk assets that require both prompt patching and forensic investigation when a severe flaw is disclosed.
The one question to put to your IT lead this week: "If our remote-access VPN was exposed to this flaw, how would we know, and what would we do about it?" If the answer is "run the Integrity Checker," this post explains why that is not enough.
If you are not sure how your organization stacks up, start with our free quick security assessment. It takes about five minutes and shows which of 22 security areas need attention first.
This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Details about CVE-2026-104935 are based on public disclosures from CISA, Ivanti and Volexity as of October 14, 2026, and may change as the investigation continues and additional patches are released. Organizations should consult qualified cybersecurity professionals before acting on any specific indicator of compromise or making operational changes based on this article.