CISA is aware of a critical vulnerability, CVE-2026-104935, impacting multiple versions of Ivanti Connect Secure. This zero-day vulnerability allows for remote, unauthenticated command execution, leading to credential theft and data exfiltration. Cyber threat actors are actively exploiting this vulnerability. CISA has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog. Organizations using affected Ivanti Connect Secure appliances must immediately update to the latest version. Ivanti provides detailed patching guidance in their security advisory and a compatibility guide. Determining compromise will likely require network and memory forensics, as Ivanti's Integrity Checker Tool may not detect exploitation. If a compromise is suspected, CISA recommends backing up configurations, performing a factory reset, and upgrading. For cloud and virtual systems, rebuilding the instance and upgrading is advised. Following the reset, restore configurations from the backup and reset all account passwords. Additionally, revoke and reissue certificates, and reset API keys and license server credentials. CISA strongly advises reviewing Ivanti's advisories and a Volexity blog post for comprehensive information.