Cyber Resilience
CISA reports active exploitation of an authentication bypass. Patching is urgent, but suspected compromise requires forensic investigation and a wider recovery effort.
By Daniel Okafor, Cyber Resilience Correspondent · · 5 min read
Businesses using affected Ivanti Connect Secure systems should update immediately and distinguish patching from investigating a possible breach. According to CISA, attackers are exploiting CVE-2026-104935 to steal credentials and exfiltrate data; Ivanti’s Integrity Checker Tool may miss the evidence because attacker commands execute in memory.
The US Cybersecurity and Infrastructure Security Agency reports active exploitation of an authentication-bypass vulnerability in Ivanti Connect Secure. The flaw allows a remote attacker to execute arbitrary commands without authenticating. This is not merely a warning about what a researcher might demonstrate: CISA says threat actors are already using it for credential theft and data exfiltration.
CISA’s alert identifies the affected versions as 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. These are separate version ranges as listed by the agency. An organisation’s first exposure check therefore needs the installed release, not simply confirmation that it uses an Ivanti product.
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue on Oct. 13, 2026. That establishes the agency’s assessment that exploitation is occurring. It does not establish that every exposed appliance has been compromised, nor does the alert provide a victim count, an industry breakdown or the identities of the attackers.
The agency urges affected organisations to install the latest version specified in Ivanti’s security advisory. Its alert does not name the fixed release numbers. Businesses should therefore take those numbers from the vendor advisory rather than infer that any release above one of the listed thresholds is necessarily the recommended destination.
The immediate business exposure extends beyond the appliance. Stolen credentials can remain useful after the software weakness has been closed, while an update cannot retrieve data already taken. The flaw thus creates two distinct tasks: remove the route of entry and determine what happened while it was available.
CISA directs organisations to both Ivanti’s security advisory and its Connect Secure 25.x Upgrade and Migration Compatibility Guide. The latter supplies patching guidance for hardware and virtual deployments. That distinction matters operationally: the alert does not present one installation procedure as suitable for every deployment.
There is also a support deadline. Ivanti Connect Secure version 22.8 reaches end of life on Jan. 31, 2027. For organisations on that branch, urgent remediation sits alongside a separate migration decision. Resolving this vulnerability does not remove the approaching end-of-life date.
The alert describes the vulnerability as a zero-day authentication bypass. For business decision-makers, the significant feature is the absence of an authentication requirement: an attacker does not first need a valid account to execute commands through the flaw. Strong account controls are therefore not a substitute for fixing the affected software.
The broader issue is the concentration of trust in access infrastructure. An appliance may hold not only its own configuration but credentials and certificates that require attention during recovery. The same management question—how much exposure accumulates around a shared access point—underlies our coverage of the risks of centralising AI access. CISA’s alert, however, identifies no AI-specific exploitation here.
No such assurance is available from this alert. CISA explicitly warns that Ivanti’s Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because threat-actor commands execute in memory. A reassuring result from that tool is consequently insufficient, on its own, to settle whether a deployment was breached.
Organisations seeking to determine whether they were compromised need network and memory forensics, according to the agency. This changes the scope of the response: confirming an installed software version is a maintenance check; identifying evidence of earlier exploitation is an investigation. A completed update answers only the first question.
CISA’s position is unusually direct: update immediately, examine the relevant vendor guidance and use the recovery procedures if compromise is suspected. Its advice separates affected systems from suspected breaches. It does not say that every organisation running a vulnerable version must be treated as a confirmed victim.
Ivanti’s disclosure and documentation provide the vendor’s response as represented in the alert. CISA points readers to the company’s security advisory, migration guide, configuration-backup instructions and recovery procedures. The supplied source contains no direct statement from an Ivanti executive and no customer account of an incident; claims about customer losses or the vendor’s handling of individual breaches would go beyond it.
The agency also recommends a Volexity blog about chained exploitation of Ivanti Connect Secure zero-days. The alert does not reproduce that research’s findings. Its recommendation should not be stretched into evidence here about a particular attacker, campaign size or additional vulnerability.
The strongest practical signal is the breadth of CISA’s recommended credential reset. Passwords are only one category: certificates, API keys and licence-server credentials also appear in the recovery instructions. This overlaps with the business concern examined in our reporting on infostealers and AI account exposure: restoring a system and restoring confidence in its secrets are different jobs.
CISA directs organisations to Ivanti’s recovery procedures and sets out the following sequence:
These are recovery instructions for suspected compromise, not merely an expanded description of patch installation. The distinction affects resourcing: rebuilding an instance, restoring configuration and replacing credentials involve more work than applying an update. The alert supplies no estimate of the downtime or cost, so neither can responsibly be assumed to be trivial—or uniform across deployments.
The credential step also requires coordination beyond whoever maintains the appliance. Domain accounts, stored certificates and API keys represent different forms of access, each explicitly covered by the recommended reset. Treating a changed administrator password as completion would leave other named recovery tasks unfinished.
For UK and US firms, the alert is a technical warning rather than a complete statement of legal obligations. It specifies neither a UK compliance requirement nor a universal private-sector remediation deadline. The distinction between technical action and regulatory duties also matters in the UK cyber-bill debate; a legal timetable should not be mistaken for evidence that a known exploited flaw can wait.
Oct. 13, 2026
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue.
Oct. 13, 2026
CISA issued its alert urging immediate updates and warning that integrity checks may miss exploitation.
Jan. 31, 2027
Ivanti Connect Secure version 22.8 is scheduled to reach end of life.
For UK and US business owners, the awkward expense is not necessarily the update itself. It is establishing whether an access system has already surrendered credentials or data, then coordinating recovery across the accounts, certificates and keys it held. CISA’s warning about the integrity checker means a reassuring tool result cannot carry the entire decision to resume normal operations. Owners need a clear distinction between money spent closing the vulnerability and money spent investigating and recovering from possible compromise. Firms running version 22.8 must also accommodate its approaching end of life, rather than mistake emergency maintenance for a lasting migration plan.
Original reporting by AI Business Reality Check. Primary source: CISA – Cybersecurity advisories (US).
Cyber Resilience
A survey of 500 US security leaders found strong demand for AI defences and ambitious spending plans. It did not establish whether those investments pay.
By Daniel Okafor · 15 Oct 2026 · 6 min read
Cyber Resilience
State security chiefs reported falling confidence in 2026 as budget cuts emerged and AI threats grew more sophisticated. Businesses share some of that exposure.
By Daniel Okafor · 15 Oct 2026 · 6 min read
Big Tech & Research
Small models can run across cheap connected devices. Anthropic has not yet shown them completing an autonomous infection cycle—a distinction that matters for security spending.
By Thomas Achterberg · 15 Oct 2026 · 6 min read
Big Tech & Research
Security researchers redirected a shopping agent despite explicit instructions to distrust webpage text. Constrained answers are not the same as constrained behaviour.
By Rajiv Menon · 15 Oct 2026 · 5 min read
