With Ivanti exploited in memory, patching alone does not close the incident
CISA says an Ivanti Connect Secure zero-day is being used to steal credentials, and the integrity checker may miss it. Patch, then hunt for compromise and reset what the appliance could reach.
What happened
On 13 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) urged organisations to patch a newly exploited vulnerability in Ivanti Connect Secure, tracked as CVE-2026-104935. CISA describes it as a zero-day authentication bypass that allows remote, unauthenticated execution of arbitrary commands. It says threat actors are exploiting it for credential theft and data exfiltration, and it added the flaw to its Known Exploited Vulnerabilities catalogue the same day.
Affected versions are Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA's guidance has several parts:
- Update immediately to the latest version, following Ivanti's security advisory.
- Determine compromise through network and memory forensics. CISA notes that Ivanti's Integrity Checker Tool may not detect exploitation because the commands run in memory.
- If compromise is suspected, back up the configuration, factory reset the appliance and upgrade, or rebuild the virtual instance for cloud and virtual systems, then restore the configuration.
- Reset passwords for all accounts (domain, administrator and local), revoke and reissue stored certificates, and reset stored API keys and licence server credentials.
CISA also notes that Ivanti Connect Secure 22.8 reaches end of life on 31 January 2027. The alert links to Ivanti's advisory, its upgrade and migration compatibility guide, and a Volexity write-up of the chained exploitation.
The facts at a glance:
| Item | Detail |
|---|---|
| Vulnerability | CVE-2026-104935, authentication bypass in Ivanti Connect Secure |
| Impact | Remote, unauthenticated execution of arbitrary commands |
| Affected | 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior |
| Alert and KEV listing | 13 October 2026 |
| 22.8 end of life | 31 January 2027 |
CISA's recovery sequence if compromise is suspected:
| Step | Action |
|---|---|
| 1 | Back up the appliance configuration |
| 2 | Factory reset and upgrade, or rebuild the virtual instance for cloud and virtual systems |
| 3 | Restore the configuration from the backup |
| 4 | Reset passwords for all domain, administrator and local accounts |
| 5 | Revoke and reissue stored certificates; reset stored API keys and licence server credentials |
Why it matters
Patched is not the same as clean. The detail that changes the response is the in-memory execution. A tool that checks files on disk can report a healthy appliance that has been compromised. Your assurance that you were not hit has to come from network and memory evidence, not from a green check.
The appliance sits at a point of trust. A remote access gateway handles credentials, certificates and keys for the whole organisation. When CISA tells you to reset domain, administrator and local passwords, and reissue certificates, it is telling you how far the blast radius extends. The appliance is not the asset at risk. The identities behind it are.
The window before the patch is the exposure. The zero-day was exploited before a fix was widely applied. If your device was reachable from the internet in that period, the question is not only whether you are patched now, but whether anyone used the gap.
Lifecycle is part of the risk. The end-of-life date for 22.8 is less than four months away. Organisations on that branch face an upgrade or migration decision that this incident makes more pressing.
What we would do
- Identify every Ivanti Connect Secure instance today. Include the ones owned by other teams, subsidiaries and suppliers. Check versions against the three affected ranges and confirm who owns patching for each.
- Patch to the latest version following Ivanti's advisory. Do it before anything else, and record the time, because the time of patching defines your exposure window.
- Hunt for compromise, do not rely on the integrity checker. Review network logs for the exposure window and arrange memory forensics on any appliance you cannot confidently clear. If you lack in-house capability, bring in an incident response provider now rather than after you find something.
- If compromise is suspected, follow CISA's recovery sequence. Back up, factory reset and upgrade (or rebuild), restore, then reset every account and revoke and reissue stored certificates, API keys and licence server credentials.
- Review what the appliance could reach. Look for unusual use of privileged accounts after the exposure window, and check your identity provider for new sessions and token activity.
- Decide the future of remote access. For 22.8 estates, plan the move before 31 January 2027. More broadly, ask whether an internet-facing appliance remains the right model for your remote access.
If you have to choose, spend the effort on the forensics and the credential reset. Patching is necessary, and the job is not finished when it is done.
The order matters in practice. Teams under pressure tend to patch, close the ticket and move on. Here, the ticket should stay open until someone has looked for evidence of use during the exposure window and, where it was found or cannot be ruled out, the credentials the appliance handled have been replaced. Agree in advance who can authorise taking a gateway offline for a rebuild, because that decision is easier before the incident than during it.
Questions we are asked
If we have patched, are we safe?
Not necessarily. The appliance may have been compromised before the patch, and CISA says Ivanti's Integrity Checker Tool may not detect exploitation because the commands run in memory. Patching stops new exploitation. Whether you were already compromised needs network and memory forensics, so treat a pre-patch exposure window as a possible incident.
Why reset passwords and certificates?
CISA reports that threat actors are using the flaw for credential theft and data exfiltration. A VPN appliance stores or handles credentials, certificates and keys, so anything it held should be assumed readable if it was compromised. Resetting limits what an attacker can reuse after you have cleaned the device.
Should we keep using appliance-based remote access?
That is a strategic decision, not an emergency one. This is an internet-facing device that needs constant patching, and the version 22.8 line reaches end of life on 31 January 2027. It is reasonable to review whether a different access model would reduce your exposure, after you have dealt with this incident.