CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog after Ivanti disclosed active exploitation of this zero-day in Connect Secure appliances. The flaw is an authentication bypass that permits remote, unauthenticated execution of arbitrary commands, affecting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
Threat actors are reportedly using the vulnerability to conduct credential theft and data exfiltration. Because VPN appliances like Connect Secure sit at the network edge and frequently broker access to internal identity systems, stolen credentials can serve as a springboard for deeper lateral movement into Active Directory and other sensitive infrastructure.
What to take away: Patch affected appliances immediately per Ivanti’s advisory. Note that CISA warns Ivanti’s Integrity Checker Tool may not reliably detect compromise, so organizations should perform network and memory forensics and treat any exposed credentials as potentially compromised, resetting them and hunting for post-exploitation identity abuse.