CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability.

The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior that could allow a remote unauthenticated attacker to execute arbitrary commands.

"CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration," the agency said.

The agency has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 16, 2026.

CISA is also recommending that customers of affected ICS deployments review Ivanti's Connect Secure Upgrade and Migration Compatibility Guide for patching guidance, cautioning that version 22.8 reaches end-of-life on January 31, 2027.

"Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation," it added.

In the event a compromise is detected, CISA is advising organizations to implement the following actions -

• Create a backup of the appliance configuration.
• Conduct a factory reset and upgrade the appliance to the latest version.
• For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
• Restore the appliance configuration from the backup created in step 1.
• Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.

The development comes as Previdian disclosed that it has observed 105 exploitation attempts targeting its honeypot sensors as of October 14, 2026. The attack attempts have originated from 50 unique IP addresses geolocated to Singapore and the U.S. Some of the observed IP addresses are listed below -

• 216.73.160[.]59
• 216.73.160[.]61
• 216.73.160[.]210
• 45.8.19[.]111

According to Previdian founder and CEO, Ryan Dewhurst, threat actors are using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts dressed up as ZIP files. The scripts return unique markers that determine whether remote code execution has succeeded.

"We're seeing coordinated attempts to exploit this Ivanti vulnerability, but the payloads captured so far are primarily testing for code execution rather than deploying malware, or compromising the device," Dewhurst told The Hacker News. "However, full weaponized exploitation is likely to follow in the coming hours and days."

In a separate report, Volexity said it first observed the exploitation of CVE-2026-104935 on October 3, 2026, with a previously undocumented threat actor dubbed UTA0576 leveraging it in conjunction with a privilege escalation vulnerability to achieve unauthenticated root-level code execution. UTA0576 is assessed to be driven by criminal motives rather than espionage.

Following successful exploitation, the threat actor is said to have engaged in broad post-exploitation actions, including extracting credentials stored on the ICS VPN appliance, exfiltrating limited Active Directory metadata, deploying a Kerberos tool capable of Kerberoast attacks and credential testing, conducting host reconnaissance, LDAP packet capture, and dropping a Python LDAP tool to search for administrator passwords and BitLocker recovery keys.

"The recovered payloads demonstrate deliberate efforts to conceal malicious activity through selective log modification, removal of temporary execution artifacts, and restoration of altered system state," Volexity researchers Charlie Gardner, Sean Koessel, and Steven Adair said.

"UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool."

Threat intelligence company Defused Cyber has also confirmed active exploitation, stating its decoys "caught pre-disclosure exploitation we assess as CVE-2026-104935" in the wild starting October 1, 2026.

"The root cause of the vulnerability is incredibly simple, with a single request containing a specially crafted 'X-DSCGI-PATH' header being all that is needed to bypass authentication and access sensitive functionality that otherwise should be restricted," Yordan Ganchev, principal threat intelligence specialist at watchTowr, said.

"Ivanti Connect Secure has long been a popular target for attackers, including ransomware gangs, and joins 14 other Ivanti Connect Secure / Pulse Connect Secure vulnerabilities on the CISA KEV list. Given the history, we expect exploitation to move incredibly quickly from targeted attacks to indiscriminate mass exploitation."

It's essential that organizations running ICS patch immediately and investigate their appliances for signs of compromise, including identifying any inbound requests featuring an "X-DSCGI-PATH" header.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.