Ivanti Connect Secure zero-day was used to run commands
On October 13, 2026, CISA said attackers were exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution. CISA added it to the exploited-vulnerabilities catalog the same day.
What was reported
CISA's October 13, 2026 alert says it knows of attackers exploiting this zero-day authentication bypass to steal credentials and take data. The bug allows remote, unauthenticated execution of arbitrary commands. CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog that day.
CISA also says Ivanti's Integrity Checker Tool may miss evidence, because the attacker's commands run in memory. Determining whether an appliance was compromised takes network and memory forensics, not only a version check.
A VPN appliance is the front door. An auth bypass there skips the login the rest of the network trusts.
How to prevent it
Update affected Connect Secure appliances using Ivanti's advisory for CVE-2026-104935. CISA says the bug hits 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. If you suspect a compromise, patching is not enough: CISA's recovery steps are a factory reset, or a rebuilt virtual instance, then a restore from a backup taken first, and a reset of every account, certificate, and stored API key. Version 22.8 reaches end of life on January 31, 2027.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.