CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

Key Points:

• CVE-2026-104935 is a newly exploited zero-day vulnerability in Ivanti Connect Secure, allowing remote, unauthenticated execution of arbitrary commands.
• The vulnerability impacts versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, leading to potential credential theft and data exfiltration.
• Organizations are urged to immediately patch affected systems by upgrading to the latest version of Ivanti Connect Secure and follow recovery procedures if exploitation is suspected.

Technical Details: CVE-2026-104935 allows attackers to bypass authentication mechanisms, enabling them to execute arbitrary commands remotely without authentication.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Defense Evasion)
• T1203 - User Execution (Execution)
• T1040 - Network Sniffing (Credential Access)

IOCs Mentioned: None mentioned