Cybersecurity
CISA warns admins to patch Ivanti flaw
CISA urged organisations to update Ivanti Connect Secure after a zero-day authentication-bypass flaw, while Ivanti and Volexity said the bug had already been used in chained attacks.
- CISA urged security teams to patch an Ivanti Connect Secure authentication-bypass flaw that had been used in zero-day attacks since at least 1 October.
- Ivanti said it released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2 on Tuesday and told customers to act immediately because it had seen limited exploitation in the wild.
- Volexity said an unknown actor it tracks as UTA0576 had chained the flaw with two others in attacks since at least 3 October.
- CISA added CVE-2026-104935 to its list of actively exploited issues and told Federal Civilian Executive Branch agencies to secure their networks by Friday.
- CISA said defenders who suspected compromise would need network and memory forensics, because Ivanti's checker might not spot exploitation that ran only in memory.
CISA said security teams should patch an Ivanti Connect Secure authentication-bypass flaw that had been used in zero-day attacks since at least 1 October. The issue was identified as CVE-2026-104935 and was said to allow remote command execution without privileges or user interaction.
Ivanti said on Tuesday that it had released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1 and 25.1.1.2 to fix the problem. It also told customers to act immediately because it had seen limited exploitation in the wild.
Volexity said an unknown actor it tracks as UTA0576 had chained the flaw with two other vulnerabilities in attacks from at least 3 October. The firm said the chain enabled root-level code execution and that the actor had sought Active Directory credentials, LAPS passwords and BitLocker recovery keys.
CISA added the flaw to its list of actively exploited issues and ordered Federal Civilian Executive Branch agencies to secure their networks by Friday under BOD 26-04. It also told defenders to update at once, check for compromise using network and memory forensics, and reset credentials and certificates if they found evidence of intrusion.
Named in this story
Companies
- Ivanti
- released fixed Connect Secure versions and warned customers to act immediately
- Volexity
- said the flaw had been chained with two others in attacks
Organisations
- UTA0576
- Volexity’s label for the unknown threat actor
- Shadowserver
- tracked more than 5,600 internet-exposed hosts with ICS fingerprints
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- urged immediate patching and added the flaw to its exploited list
- Federal Civilian Executive Branch
- the agencies CISA ordered to secure by Friday
Products and systems
- Ivanti Connect Secure
- the appliance software affected by the flaw
How the source tells it
The piece read like a standard security alert, with urgency coming from repeated calls to patch immediately and a fixed deadline rather than from sensational language.
- urgency repeated imperatives and a Friday deadline