CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
Summary: CISA urged organizations on Tuesday to immediately update Ivanti Connect Secure appliances after an authentication bypass tracked as CVE-2026-104935 (CVSS 8.6) was disclosed as actively exploited, affecting versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 and prior. Previdian reported 105 exploitation attempts against its honeypots from 50 unique IP addresses in Singapore and the U.S. as of October 14, 2026, and Volexity said it first observed exploitation on October 3, 2026 by a criminal actor it calls UTA0576.
Why it matters: Volexity found UTA0576 deployed no malware or web shell, re-exploiting the device for every command and tampering with logs to evade Ivanti's Integrity Checker Tool, so a clean scan may not mean a clean appliance. The flaw joins 14 other Ivanti Connect Secure and Pulse Connect Secure vulnerabilities on CISA's KEV list, and watchTowr expects exploitation to move quickly from targeted attacks to indiscriminate mass exploitation.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104935
- Related
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 13, 2026