Ivanti CVE-2026-104935: What to Do Now

Update affected Ivanti Connect Secure appliances immediately and assess possible compromise separately. CISA says CVE-2026-104935 is being exploited for credential theft and data exfiltration, and its memory-based execution may evade Ivanti’s Integrity Checker Tool (CISA’s October 13 alert). Verify the platform-specific update path; suspected compromise requires recovery and credential remediation, not patching alone.

The Cybersecurity and Infrastructure Security Agency (CISA) added this Common Vulnerabilities and Exposures (CVE) identifier to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026, and urged immediate updates (CISA’s October 13 alert). Ivanti confirms exploitation affecting a limited number of customers at disclosure and provides fixed releases (Ivanti security advisory). We recommend parallel appliance remediation and identity exposure review.

What are the key takeaways?

• The authentication bypass allows remote, unauthenticated execution of arbitrary commands (CISA’s October 13 alert).
• Resolved releases include 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5, but platform compatibility determines the appropriate path (Ivanti security advisory).
• A negative Integrity Checker result cannot rule out this exploitation; CISA calls for network and memory forensics (CISA’s October 13 alert).
• For suspected compromise, CISA recommends reset or rebuild, upgrade, configuration restoration, and password and secret remediation (CISA’s October 13 alert).

What happened, and who should act?

CISA reports active exploitation of Ivanti Connect Secure (ICS) CVE-2026-104935 for credential theft and data exfiltration. Its October 13 alert identifies affected releases as 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior (CISA’s October 13 alert).

Use Ivanti’s branch-specific details rather than treating those ranges as a blanket statement about every older release. The vendor explicitly says 22.7R2.14 and prior do not contain this vulnerability (Ivanti security advisory). That exception is not a recommendation to downgrade or a statement that those versions have no other security issues.

BleepingComputer’s October 14 reporting corroborates active attacks and CISA’s call for immediate patching across affected organizations (BleepingComputer reporting). Do not wait merely because you are outside federal government.

Which update path should administrators use?

Match the appliance model and running release to Ivanti’s advisory before changing software. The following table summarizes selected vendor guidance, not a substitute for the complete compatibility review.

Ivanti lists 25.1.3.0 and 25.1.3.1 among resolved versions and directs customers to its 25.x Upgrade and Migration Compatibility Guide (Ivanti security advisory). Do not assume a new image can be installed in place on every appliance. Record the selected path, owner, maintenance plan, and evidence that the intended release is running.

Our managed patch management service is relevant to deployment coordination. It should not be treated as a replacement for the compromise assessment described below.

Does a clean Integrity Checker result mean we are safe?

No. CISA warns that the Integrity Checker Tool may miss evidence because attacker commands execute in memory, and says determining compromise requires network and memory forensics (CISA’s October 13 alert).

We recommend involving qualified incident responders before destructive recovery steps where feasible, so evidence collection and containment can be coordinated. Do not delay urgent risk reduction indefinitely while waiting for perfect evidence, and do not label an appliance clean solely because one tool found nothing.

Assign an owner to the investigation decision and document available records, evidence gaps, and what was collected before reset or rebuild. The Microsoft 365 incident-log guide can support a related identity investigation, but those logs are not a substitute for appliance, network, or memory evidence.

What should happen if compromise is suspected?

Follow the coordinated recovery process referenced by CISA, not an update-only closure. CISA’s October 13 alert recommends the sequence below for suspected compromise (CISA’s October 13 alert).

1. Back up the appliance configuration. Follow the vendor’s configuration backup instructions (CISA’s October 13 alert).
2. Reset or rebuild and upgrade. Factory-reset hardware appliances and upgrade; rebuild cloud or virtual instances and upgrade (CISA’s October 13 alert).
3. Restore configuration. CISA specifies restoration from the configuration backup created earlier (CISA’s October 13 alert). We recommend having the response team review restoration decisions and dependencies.
4. Remediate credentials and secrets. CISA calls for resetting passwords for all accounts, including domain, administrator, and local accounts; revoking and reissuing stored certificates; and resetting stored application programming interface (API) keys and license-server credentials (CISA’s October 13 alert).

Coordinate these actions with identity and service owners. Our recommendation is to track each required action through verification, including dependent services, rather than declare recovery complete when the appliance becomes reachable again.

How would our SOC handle the response?

Our U.S.-based security operations center (SOC) would track patch verification, forensic review, and credential remediation separately. We would ask the appliance owner for the exact running release while responders assess available evidence and identity owners plan the required secret changes.

We would report unresolved exposure and evidence limitations without treating a clean checker result as proof. This is our proposed approach, not a customer incident. Use the managed SOC pricing guide to clarify monitoring and response responsibilities.

What else should administrators know?

Is this vulnerability actively exploited?

Yes. CISA reports exploitation for credential theft and data exfiltration, and Ivanti confirms exploitation affecting a limited number of customers at disclosure (CISA’s October 13 alert) (Ivanti security advisory).

Can we rely only on the Integrity Checker Tool?

No. CISA warns that memory-based execution may evade the tool and calls for network and memory forensics to determine compromise (CISA’s October 13 alert).

Can every appliance move directly to 25.1.3.0?

No. Ivanti says that migration requires the new platform, with new physical servers for hardware deployments or newly built devices using the appropriate template for virtual and cloud deployments (Ivanti security advisory).

Does patching replace credential remediation?

No. For suspected compromise, CISA’s recovery recommendations include password resets, certificate revocation and reissuance, and resetting stored API keys and license-server credentials (CISA’s October 13 alert).

Need help verifying remediation?

Bring your appliance inventory, update plan, and response questions to a focused review. Schedule a security review or Call 833-92-CYBER to clarify remediation and investigation responsibilities.