Scope - What This Guide Covers
This guide focuses on the operational response to actively exploited vulnerabilities in enterprise VPN and remote access infrastructure, using CVE-2026-104935 in Ivanti Connect Secure as a case study. You'll find requirement breakdowns, implementation steps, and forensic guidance applicable to any zero-day scenario where traditional detection tools fail and memory-resident exploitation is suspected.
This isn't about one vendor's patch cycle. It's about building a repeatable process for the next critical advisory that drops unexpectedly.
Key Concepts and Definitions
Authentication Bypass Vulnerability: A flaw allowing attackers to bypass login controls without valid credentials. CVE-2026-104935 permits remote command execution on Ivanti Connect Secure systems without user interaction or privilege escalation.
Zero-Day Exploitation: Active abuse of a vulnerability before patches are available or widely deployed. Volexity observed threat actor UTA0576 chaining CVE-2026-104935 with two additional flaws since October 3, creating an unauthenticated root-level code execution path.
Memory-Resident Execution: Attack techniques that execute malicious commands in volatile memory rather than writing files to disk. This approach evades signature-based detection and complicates forensic analysis. Ivanti's Integrity Checker Tool cannot detect CVE-2026-104935 exploitation because threat actor commands execute in memory.
Binding Operational Directive (BOD): Mandatory cybersecurity instructions issued by CISA to Federal Civilian Executive Branch agencies. BOD 26-04, issued in June, requires agencies to remediate actively exploited vulnerabilities within specified timeframes.
Requirements Breakdown
CISA BOD 26-04 Compliance Timeline
Federal agencies received a Friday deadline to secure networks against CVE-2026-104935 exploitation. While this directive applies exclusively to FCEB agencies, it establishes the government's risk tolerance threshold for actively exploited flaws.
Affected Versions and Remediation Targets
Ivanti released patches on Tuesday:
- ICS 22.8R2.5
- ICS 25.1.3.0
- ICS 25.1.3.1
- ICS 25.1.1.2
If you're running earlier versions, you're operating exposed infrastructure against a known-exploited vulnerability.
Post-Compromise Actions Observed
Volexity documented the following threat actor objectives after successful exploitation:
- Active Directory credential harvesting
- Local Administrator Password Solution (LAPS) password extraction
- BitLocker recovery key theft
These targets indicate lateral movement preparation and data exfiltration capabilities.
Implementation Guidance
Immediate Triage (Hours 0-4)
Inventory exposed systems: Shadowserver tracks over 5,600 Internet-exposed hosts with ICS fingerprints. Your first step is confirming whether your perimeter includes vulnerable appliances. Don't assume your asset inventory is current.
Assess exploitation evidence: Traditional indicators of compromise won't surface memory-resident attacks. You'll need network traffic analysis and memory forensics capabilities. If you don't have these tools staged, you're operating blind during the critical detection window.
Isolate before patching: If you discover evidence of compromise, containment precedes remediation. Patching an already-compromised system without isolation simply preserves attacker access.
Remediation Process (CISA-Recommended)
For confirmed compromises, CISA mandates a complete rebuild sequence:
- Configuration backup: Preserve appliance settings before any destructive action.
- Factory reset: For cloud and virtual deployments, rebuild the virtual instance entirely.
- Upgrade to patched version: Apply the latest ICS release during the rebuild.
- Configuration restoration: Reapply backed-up settings to the clean build.
- Credential rotation: Reset passwords for domain accounts, administrator accounts, and local accounts; revoke and reissue certificates; reset API keys and license server credentials.
This sequence assumes the configuration itself isn't compromised. If attackers modified authentication policies or access controls, restoring that configuration reintroduces the vulnerability.
Detection Limitations You Must Acknowledge
Ivanti's own tooling cannot detect CVE-2026-104935 exploitation. This creates a verification gap: you can't confirm you're clean using vendor-provided utilities. Network and memory forensics become mandatory, not optional.
If your security operations center lacks memory analysis capabilities, you're relying on hope rather than evidence. Consider whether your incident response retainer includes forensic specialists with appliance-specific expertise.
Common Pitfalls
Assuming patch deployment equals security: Patching vulnerable systems doesn't remediate existing compromises. Attackers who gained access before your patch window retain their foothold unless you follow CISA's full rebuild process.
Trusting vendor detection tools exclusively: The Integrity Checker Tool's inability to detect this exploitation pattern isn't unique to Ivanti. Vendor-provided security utilities frequently lag behind attacker techniques. Your detection strategy must include independent verification methods.
Delaying credential rotation: Organizations often patch systems but postpone the password reset and certificate reissuance steps. Stolen LAPS passwords and BitLocker keys remain valid until you rotate them. Threat actors know this and exploit the gap.
Overlooking the exploit chain: CVE-2026-104935 was chained with two other vulnerabilities to achieve root-level execution. Patching the authentication bypass without addressing the complete attack path leaves partial exposure. Review Ivanti's complete advisory for the full vulnerability set.
Treating BOD deadlines as private-sector irrelevant: Federal agencies received a 72-hour remediation window. If CISA assesses that timeline as appropriate for government risk tolerance, your organization's acceptable risk threshold probably isn't more permissive. The Friday deadline signals severity, not bureaucratic preference.
Quick Reference Table
| Action | Timeline | Responsibility | Verification Method |
|---|---|---|---|
| Identify exposed ICS instances | Hour 0-2 | Network Operations | Asset inventory + external scan validation |
| Assess for compromise indicators | Hour 2-8 | Security Operations | Network forensics + memory analysis |
| Isolate confirmed compromises | Immediate upon detection | Incident Response | Network segmentation confirmation |
| Backup appliance configuration | Pre-remediation | System Administration | Configuration export validation |
| Factory reset + upgrade | Maintenance window | System Administration | Version verification post-build |
| Restore configuration | Post-upgrade | System Administration | Functionality testing |
| Rotate all credentials | Within 24h of rebuild | Identity Management | Credential age audit |
| Revoke/reissue certificates | Within 24h of rebuild | Public Key Infrastructure Administration | Certificate validity verification |
| Reset API keys + license credentials | Within 24h of rebuild | Application Owners | Authentication testing |
Forensic Capability Requirements
- Network traffic capture and analysis (minimum 30-day retention)
- Memory acquisition and analysis tools
- Active Directory audit log correlation
- LAPS password access logging
- BitLocker key access monitoring
If you lack these capabilities, your ability to determine whether you've been compromised is severely limited. This isn't a gap you can close during an active incident.
For ongoing reference: CISA maintains its Known Exploited Vulnerabilities Catalog. The agency has added 36 Ivanti vulnerabilities to this list since November 2021, with 12 subsequently used in ransomware attacks. If your infrastructure depends on Ivanti products, treat this catalog as required reading, not optional threat intelligence.
