CISA urges immediate patching of exploited Ivanti Connect Secure flaw that may evade Ivanti's own integrity tool
Patching closes the door but does not establish whether an attacker is already inside, and the vendor's own check cannot be relied on to answer that question. Organisations running these gateways should commission memory and network forensics, rotate credentials that pass through the appliance, and treat any clean integrity-tool result as inconclusive. With 22.8 nearing end of life, this is also the moment to budget and schedule migration rather than defer it into a second incident cycle.
What Happened
CISA urged organisations running affected Ivanti Connect Secure appliances to update to the latest version immediately and added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog. CISA said checking for compromise will require network and memory forensics, warning that Ivanti's Integrity Checker Tool may not detect exploitation because threat actor commands run in memory. Ivanti Connect Secure 22.8 reaches end of life on 31 January 2027.
Why It Matters
Patching closes the door but does not establish whether an attacker is already inside, and the vendor's own check cannot be relied on to answer that question. Organisations running these gateways should commission memory and network forensics, rotate credentials that pass through the appliance, and treat any clean integrity-tool result as inconclusive. With 22.8 nearing end of life, this is also the moment to budget and schedule migration rather than defer it into a second incident cycle.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (2026-10-13)
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-13)
More From This Briefing
- EU AI Office opens first AI Act enforcement test over OpenAI and Anthropic agent incidents
- CISA flags actively exploited flaws in Palo Alto PAN-OS, Cisco Secure Email Gateway and Ahsay backup
- CISA adds actively exploited Microsoft Windows command injection flaw CVE-2026-96951 to KEV catalog
- Virginia bill proposes three-year statewide moratorium on data centre approvals from July 2027
This story is part of the Laurenceo Intelligence briefing for 16 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.