CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

CISA has flagged an Ivanti Connect Secure (ICS) authentication bypass, CVE-2026-104935, as actively exploited since at least October 1, giving federal agencies until Friday to secure their systems under Binding Operational Directive 26-04. The high-severity flaw allows an unauthenticated attacker to run arbitrary commands remotely without any user interaction, and Ivanti shipped fixes in versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 while urging customers to patch immediately. Security firm Volexity says a threat group it calls UTA0576 has been chaining this bug with two additional vulnerabilities since October 3 to gain unauthenticated root access, then stealing Active Directory credentials, LAPS passwords, and BitLocker recovery keys. Shadowserver counts more than 5,600 internet-facing ICS devices, and CISA warns that Ivanti's Integrity Checker Tool may miss signs of compromise since attacker commands run only in memory, recommending a factory reset, credential rotation, and certificate reissuance for affected appliances.