CISA Advises Immediate Action on Ivanti Connect Secure Vulnerability

Overview

CISA has issued an alert regarding a newly discovered vulnerability in Ivanti Connect Secure, designated as CVE-2026-104935. This vulnerability is being exploited by cyber threat actors to bypass authentication, enabling them to execute arbitrary commands remotely without authentication.

Recommended Actions

Organizations using affected versions of Ivanti Connect Secure are strongly advised to take immediate action. CISA emphasizes the importance of updating to the latest version as per Ivanti's security advisory. Additionally, organizations should review the compatibility guide for detailed patching instructions.

For those concerned about potential compromise, conducting thorough network and memory forensics is essential to identify any exploitation evidence. Note that Ivanti's Integrity Checker Tool may not detect this specific vulnerability.

Steps to Mitigate Risk

If a compromise is suspected, organizations should follow these recovery procedures:

• Create a backup of the appliance configuration.
• Conduct a factory reset and upgrade to the latest version.
• For cloud and virtual systems, rebuild the virtual instance and upgrade.
• Restore the appliance configuration from the backup.
• Reset passwords for all accounts and revoke stored certificates.
• Reset API keys and license server credentials.

By taking these steps, organizations can significantly reduce their risk of exploitation and enhance their overall security posture.