# CISA warns Ivanti integrity checker may miss exploited VPN flaw

_Published Tuesday, October 13, 2026 at 7:18 PM EDT · Security · Latest · Tier 2 — Notable_

![CISA warns Ivanti integrity checker may miss exploited VPN flaw — Primary](https://cyberscoop.com/wp-content/uploads/sites/3/2025/04/WAWPWY.jpg)

CISA added Ivanti Connect Secure vulnerability CVE-2026-104935 to its known exploited vulnerabilities catalog Tuesday and warned that Ivanti's Integrity Checker Tool may miss evidence of compromise because attacker commands execute in memory. The agency urged customers to patch quickly and use network and memory forensics to investigate exploitation.

Ivanti said it discovered part of the vulnerability during internal checks in June but scheduled a fix for its normal release cycle. Volexity confirmed exploitation from Oct. 1 and observed credential theft, data exfiltration and log tampering.

Ivanti says its patch eliminates the primary unauthenticated remote code execution path, while another vulnerability in the attack chain still requires an update. The full scope of compromise remains under investigation.

## Sources

- [CyberScoop](https://cyberscoop.com/ivanti-connect-secure-zero-day-actively-exploited/)

---
Canonical: https://techandbusiness.org/newswire/sYXnvdP1mHCuwAAw1xRq8Q
Published: 2026-10-13T23:18:24.689Z
Story chronology: 2026-10-13T22:10:42.000Z
Retrieved: 2026-10-14T01:42:20.840Z
Publisher: Tech & Business (techandbusiness.org)