CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

Ivanti Connect Secure is a security appliance used in organizational networks, including for VPN access. Its position at the network boundary makes it important: it can handle remote connections and store information needed to authenticate users or reach internal resources. The article does not provide a full product definition, but it identifies the appliance as an ICS VPN device.

A compromised appliance can expose stored VPN credentials and enable access to internal network information. Volexity reported that UTA0576 extracted credentials from the appliance, collected limited Active Directory metadata, and searched for administrator passwords and BitLocker recovery keys. Those actions show why the device can become a bridge into broader network activity.

The risk is not limited to the appliance itself. Attackers also conducted reconnaissance, captured LDAP traffic, and deployed tools for credential testing. Organizations must therefore treat a compromised ICS deployment as a possible wider network incident, not merely a device needing a routine update.

CVE-2026-104935 is an authentication-bypass vulnerability in Ivanti Connect Secure. It affects versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA says a remote, unauthenticated attacker can use it to execute arbitrary commands. The flaw has a CVSS score of 8.6 and is being actively exploited.

Authentication normally requires a system to check a user's identity before granting access. An authentication bypass allows the attacker to skip that check. In this case, the attacker can send requests remotely and reach command-execution functionality without valid credentials. Previdian observed attackers using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files.

The danger is immediate control of a security appliance. CISA linked exploitation to credential theft and data exfiltration. Volexity also reported root-level code execution and extensive post-exploitation activity, showing how quickly the flaw can become a broader incident.

Previdian observed 105 exploitation attempts against its honeypot sensors as of October 14, 2026. The attempts came from 50 unique IP addresses geolocated to Singapore and the United States. The article also lists four example addresses, including 216.73.160[.]59 and 45.8.19[.]111.

These figures show repeated activity from many network sources, rather than one isolated probe. They do not establish that every address represents a separate attacker, because the article does not identify the operators behind them. However, the number and geographic distribution demonstrate that exploitation attempts were already active across multiple sources.

Previdian founder Ryan Dewhurst said the captured payloads mainly tested whether code execution worked. They were not yet primarily deploying malware or compromising the device. He warned that fully weaponized exploitation was likely in the following hours and days, while Volexity had already observed exploitation beginning October 3.

A successful attack can turn an Ivanti Connect Secure appliance into a foothold for theft and follow-on operations. CISA said threat actors were using the flaw for credential theft and data exfiltration. Because the appliance is involved in VPN access, stolen information may help attackers understand or reach connected organizational systems, although the article does not quantify the resulting network access.

Volexity described a detailed example involving UTA0576. After obtaining unauthenticated root-level code execution, the actor extracted credentials from the VPN appliance and exfiltrated limited Active Directory metadata. The actor also performed host reconnaissance, captured LDAP packets, and dropped a Python LDAP tool to search for administrator passwords and BitLocker recovery keys.

The activity included a Kerberos tool for Kerberoast attacks and credential testing. Attackers also removed temporary artifacts, selectively modified logs, and restored altered system state. These actions can make detection harder, so organizations must investigate both the appliance and related network activity after suspected exploitation.

CISA places vulnerabilities in its Known Exploited Vulnerabilities catalog when there is evidence that threat actors are exploiting them. For CVE-2026-104935, CISA explicitly reported active exploitation of an authentication bypass that enables remote, unauthenticated command execution. The agency connected the activity to credential theft and data exfiltration.

The catalog entry creates a mandatory deadline for Federal Civilian Executive Branch agencies. They must apply the available fixes by October 16, 2026. CISA also urged organizations more broadly to update affected Ivanti Connect Secure appliances and deployments immediately. Customers were directed to Ivanti's Connect Secure Upgrade and Migration Compatibility Guide for patching guidance.

The warning includes a lifecycle concern. Ivanti Connect Secure version 22.8 reaches end-of-life on January 31, 2027. Organizations using that branch must plan beyond the immediate patch and account for the approaching end of support, while investigating possible compromise rather than assuming an update ends the incident.

CISA says organizations trying to determine whether an Ivanti Connect Secure appliance was compromised should conduct network and memory forensics. These investigations can identify evidence of commands, payloads, altered processes, or related network activity. The article does not provide a specific forensic tool or detection signature, so the recommendation remains an investigation requirement rather than a single test.

If compromise is confirmed, CISA recommends more than installing an update. Organizations should back up the appliance configuration, perform a factory reset, and upgrade to the latest version. Cloud and virtual systems should be rebuilt and upgraded. The clean configuration backup can then be restored.

CISA also recommends resetting every account password, including domain, administrator, and local accounts. Stored certificates should be revoked and reissued, while API keys and license server credentials should be reset. These steps address secrets that attackers may already have copied before remediation.

Remote unauthenticated command execution occurs when a network-accessible service accepts attacker-controlled requests and runs commands without first validating a user's identity. The attacker does not need a legitimate account for the initial action. In CVE-2026-104935, CISA says this capability comes from an authentication bypass in Ivanti Connect Secure.

The observed mechanism involved the X-DSCGI-PATH header reaching an internal CGI handler. Previdian said attackers used that path to upload Perl scripts disguised as ZIP files. The scripts returned unique markers, allowing attackers to check whether remote code execution had succeeded. Volexity later reported unauthenticated root-level execution in observed attacks.

Once commands run on a security appliance, attackers can inspect stored secrets, alter files, and gather information about connected systems. The article documents credential extraction, Active Directory metadata collection, LDAP capture, reconnaissance, and credential testing. Those steps can move an incident beyond one appliance, although the article does not claim every compromise reached full organizational control.