CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

CISA has issued an emergency directive telling organizations to immediately patch Ivanti Connect Secure (ICS) appliances after confirming active exploitation of a newly disclosed zero-day. The flaw, CVE-2026-104935 (CVSS 8.6), is an authentication bypass affecting ICS versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, letting unauthenticated remote attackers run arbitrary commands, steal credentials, and exfiltrate data. The bug has been added to CISA's Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by October 16, 2026, and the agency warns version 22.8 reaches end-of-life on January 31, 2027.

Security firm Previdian reported 105 exploitation attempts against its honeypots as of October 14, 2026, originating from 50 distinct IPs tied to Singapore and the U.S., with attackers abusing an X-DSCGI-PATH header to upload disguised Perl scripts and probe for code execution. Separately, Volexity says it detected exploitation as early as October 3, 2026, by a financially motivated actor named UTA0576, who chained the bug with a privilege-escalation flaw to gain root access, harvest credentials, run Kerberoasting and LDAP reconnaissance tools, and erase forensic traces of the intrusion.