CISA: Patch Ivanti Connect Secure Now — Zero-Day Steals VPN Logins

CISA just put Ivanti Connect Secure on the must-patch list. Tracked as CVE-2026-104935, this authentication-bypass flaw lets remote attackers run commands on vulnerable VPN appliances without logging in. Ivanti says exploitation is limited but real; CISA added it to the Known Exploited Vulnerabilities catalog on October 13, 2026.

Threat researchers report attackers chaining the bypass with other flaws to reach root-level code execution, then hunting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. Shadowserver still sees thousands of internet-exposed Connect Secure hosts — many of them belonging to small and midsize businesses that treat the VPN as “set and forget.”

Why this matters for small businesses

A business VPN is the front door for remote staff, accountants, and vendors. When that door has a zero-day, stolen sessions and domain credentials travel faster than a help-desk ticket. Clinics, law firms, contractors, and multi-site shops that leave Connect Secure (or similar appliances) on a public IP without patch monitoring are the easy targets.

This is the same pattern we saw with other edge gear this month: internet-facing firewalls and VPNs get weaponized within days of disclosure. Waiting for a quiet weekend is how lockouts and ransomware start.

Practical next steps (this week)

1. Confirm you run Ivanti Connect Secure. Check the appliance admin UI or ask your MSP/vendor for the product name and version (22.8.x or 25.x lines are in scope for the fixed builds).
2. Upgrade to a fixed build immediately. Ivanti released 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1 — pick the build that matches your code line. Version 22.8 reaches end of life on January 31, 2027, so plan a move to 25.x soon.
3. Assume compromise if the box was internet-exposed before the patch. Back up the config, factory-reset (or rebuild virtual appliances), upgrade, restore config, then reset all passwords, reissue certificates, and rotate API keys and license credentials. CISA notes Ivanti’s Integrity Checker may miss in-memory exploitation — network and memory forensics matter.
4. Lock down exposure. Prefer MFA on every VPN account, restrict admin interfaces to trusted IPs, and keep the appliance off flat internet exposure when a better pattern exists.
5. Watch for odd remote logins. After patching, review VPN and Domain Controller logs for unfamiliar accounts, new local admins, or LAPS/BitLocker secret reads.

For South Texas teams on-site: walk the rack, photograph the Connect Secure version screen, and text it to whoever owns IT before end of day. For remote-managed clients nationwide: ask your MSP for a written confirmation that every internet-facing VPN appliance is on a fixed build — and whether compromise assessment was done.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans help remote clients across the U.S. with edge-device patching, MFA, monitoring, and incident response coordination. Request a quote or see our monthly plans.

Sources: CISA — Patch newly exploited Ivanti Connect Secure; BleepingComputer coverage.