CISA Urges Immediate Ivanti Connect Secure Updates as Exploitation Widens

CISA Adds Ivanti Flaw to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following disclosure of an actively exploited authentication bypass vulnerability tracked as CVE-2026-104935 (CVSS score: 8.6).

The flaw affects ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and could allow a remote unauthenticated attacker to execute arbitrary commands. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by October 16, 2026. The agency also noted that version 22.8 reaches end-of-life on January 31, 2027, and directed customers to Ivanti's Connect Secure Upgrade and Migration Compatibility Guide for patching guidance.

CISA said organizations seeking to determine whether they were compromised will need to conduct network and memory forensics. If a compromise is detected, the agency recommends creating a backup of the appliance configuration, performing a factory reset and upgrading to the latest version, rebuilding virtual instances for cloud and virtual systems, restoring the configuration from the backup, resetting all account passwords including domain, administrator, and local accounts, and revoking and reissuing stored certificates while resetting stored API keys and license server credentials.

Honeypots Record 105 Exploitation Attempts

The advisory comes as Previdian disclosed observing 105 exploitation attempts targeting its honeypot sensors as of October 14, 2026. The attempts originated from 50 unique IP addresses geolocated to Singapore and the U.S., including 216.73.160.59, 216.73.160.61, 216.73.160.210, and 45.8.19.111.

Previdian founder and CEO Ryan Dewhurst said threat actors are using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files. The scripts return unique markers that determine whether remote code execution has succeeded. According to Dewhurst, the payloads captured so far are primarily testing for code execution rather than deploying malware or compromising the device, but full weaponized exploitation is likely to follow in the coming hours and days.

Threat Actor UTA0576 Achieves Root-Level Code Execution

In a separate report, Volexity said it first observed exploitation of CVE-2026-104935 on October 3, 2026, with a previously undocumented threat actor dubbed UTA0576 leveraging it in conjunction with a privilege escalation vulnerability to achieve unauthenticated root-level code execution. Volexity assesses UTA0576 to be driven by criminal motives rather than espionage.

Following successful exploitation, the threat actor engaged in broad post-exploitation activity, including extracting credentials stored on the ICS VPN appliance, exfiltrating limited Active Directory metadata, deploying a Kerberos tool capable of Kerberoasting attacks and credential testing, conducting host reconnaissance and LDAP packet capture, and dropping a Python LDAP tool to search for administrator passwords and BitLocker recovery keys. Volexity researchers Charlie Gardner, Sean Koessel, and Steven Adair said the recovered payloads demonstrate deliberate efforts to conceal malicious activity through selective log modification, removal of temporary execution artifacts, and restoration of altered system state.

Sources: The Hacker News