Ivanti's VPN gateway has another zero-day, and this one's already being exploited.
CISA confirmed on October 13 that attackers are actively exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure. The flaw hits versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, letting an unauthenticated attacker run arbitrary commands on the appliance to steal credentials and exfiltrate data. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day and is telling organizations to patch immediately. Worse, Ivanti's own Integrity Checker Tool may miss signs of the attack, since the malicious commands run in memory instead of writing to disk.
Ivanti Connect Secure has been a recurring target for serious intrusions over the past couple of years, and once again the fix is not just a version bump. CISA's recovery guidance calls for a factory reset, reissued certificates, reset API keys, and new passwords across every account - domain, admin, and local. That is the real cost of a bug like this: forensics and rebuilds, not a quiet patch Tuesday.
CISA points to a Volexity writeup already detailing the exploitation chain, which is usually a sign defenders are playing catch-up.