CISA Calls for Ivanti Connect Secure Updates Amid Active Exploitation
Ivanti flaw added to CISA’s exploited-vulnerability list
The U.S. Cybersecurity and Infrastructure Security Agency has urged organizations to update Ivanti Connect Secure appliances and deployments immediately after the disclosure of CVE-2026-104935. The vulnerability is an authentication bypass with a CVSS score of 8.6 and is being actively exploited.
CISA added the issue to its Known Exploited Vulnerabilities catalog and directed Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026. The agency said threat actors have used the zero-day flaw for credential theft and data exfiltration.
CVE-2026-104935 affects Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. A remote, unauthenticated attacker can exploit the flaw to execute arbitrary commands. Ivanti customers are also being directed to the vendor’s Connect Secure Upgrade and Migration Compatibility Guide when planning remediation.
Honeypots show coordinated probing
Previdian had recorded 105 exploitation attempts against its honeypot sensors as of October 14, 2026. The activity came from 50 distinct IP addresses geolocated to Singapore and the United States, indicating that exposure to the vulnerable service was already attracting broad scanning and exploit testing.
Previdian founder and CEO Ryan Dewhurst said attackers were using the X-DSCGI-PATH header to access an internal CGI handler and upload Perl scripts presented as ZIP files. The scripts returned unique markers intended to establish whether remote code execution had worked. The payloads seen at that point were primarily testing execution rather than deploying malware or compromising devices, although Dewhurst warned that more fully weaponized activity could follow.
Observed intrusions went beyond initial access
Volexity first observed exploitation on October 3, 2026. It attributed the activity to a previously undocumented actor tracked as UTA0576, assessed as criminally motivated rather than espionage-driven. The group combined CVE-2026-104935 with a privilege-escalation vulnerability to obtain unauthenticated root-level code execution.
After access was established, Volexity observed credential extraction from the ICS VPN appliance, limited Active Directory metadata exfiltration, host reconnaissance, LDAP packet capture and deployment of tools for Kerberoasting, credential testing, administrator-password searches and BitLocker recovery-key searches. Researchers also found indications of selective log modification, removal of temporary execution artifacts and restoration of altered system state.
Response requires remediation and investigation
CISA said organizations seeking evidence of compromise will need network and memory forensics. Where compromise is detected, its recommended process starts with backing up the appliance configuration, then factory-resetting and upgrading the appliance. Cloud and virtual deployments should be rebuilt as virtual instances and upgraded before configuration is restored.
Organizations should then reset domain, administrator and local-account passwords, revoke and reissue stored certificates, and reset stored API keys and license-server credentials. Version 22.8 reaches end of life on January 31, 2027, making upgrade planning especially relevant for users of that release. The practical implication is that teams should treat an affected Ivanti Connect Secure appliance as an incident-response priority, combining patching with evidence collection and credential recovery measures.