U.S. cyber agency says hackers are exploiting a new hole in Ivanti remote-access software used by many organizations

The alert is dated Oct. 13, 2026. The Cybersecurity and Infrastructure Security Agency, CISA, says it knows of attackers exploiting a newly disclosed hole in Ivanti Connect Secure. That is software organizations use to reach their networks from outside.

The flaw is numbered CVE-2026-104935. CVE is short for Common Vulnerabilities and Exposures, the public numbering system for known software holes. CISA calls this one a zero-day authentication bypass. A zero-day here means attackers were already using a newly disclosed hole. An authentication bypass means a person can skip the login. CISA says that person can then run commands on an affected appliance from afar, steal credentials, and take data.

The versions CISA names are Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. It says version 22.8 reaches end of life on Jan. 31, 2027.

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog

CISA says an organization that wants to know whether it was broken into will need network and memory forensics. It says Ivanti’s Integrity Checker Tool may not detect this attack, because the commands run in memory.

The alert points to Ivanti’s security advisory, a patching guide, and recovery steps, and to a write-up by the company Volexity. This desk did not open those pages. The alert does not name any victim, and it does not say how many organizations have been hit.