CISA warns Ivanti integrity checker may miss exploited VPN flaw

CISA added Ivanti Connect Secure vulnerability CVE-2026-104935 to its known exploited vulnerabilities catalog Tuesday and warned that Ivanti's Integrity Checker Tool may miss evidence of compromise because attacker commands execute in memory. The agency urged customers to patch quickly and use network and memory forensics to investigate exploitation. Ivanti said it discovered part of the vulnerability during internal checks in June but scheduled a fix for its normal release cycle. Volexity confirmed exploitation from Oct. 1 and observed credential theft, data exfiltration and log tampering. Ivanti says its patch eliminates the primary unauthenticated remote code execution path, while another vulnerability in the attack chain still requires an update. The full scope of compromise remains under investigation.