CISA Urges Immediate Ivanti Connect Secure Patching After Active Exploitation
Summary
CISA urges immediate patching of actively exploited Ivanti Connect Secure authentication-bypass flaw CVE-2026-104935. Reports describe credential theft and data exfiltration; honeypots recorded 105 exploit attempts by October 14.
Key points
- CVE-2026-104935 is an authentication bypass affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; it may enable remote unauthenticated command execution.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and set an October 16, 2026 patch deadline for federal civilian agencies.
- CISA advises affected organizations to update immediately, consult Ivanti’s upgrade and migration guidance, and conduct network and memory forensics if checking for compromise.
- Previdian reported 105 honeypot exploitation attempts from 50 IP addresses as of October 14; captured payloads primarily tested for code execution.
- Volexity reported exploitation since October 3 by UTA0576, including credential theft, limited Active Directory data exfiltration, reconnaissance, and log tampering.
- Researchers described exploitation using a specially crafted X-DSCGI-PATH header to access an internal CGI handler.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote command execution
- Severity
- CVSS 8.6
- Affected Versions
- Ivanti Connect Secure 25.1.1.1 and prior
- Ivanti Connect Secure 25.1.2.2 and prior
- Ivanti Connect Secure 22.8R2.4 and prior
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
People
Charlie GardnerVolexity researcher who described recovered payloads and UTA0576's activity.Ryan DewhurstPrevidian founder and CEO who described the observed exploitation attempts and payload behavior.Sean KoesselVolexity researcher who described recovered payloads and UTA0576's activity.Steven AdairVolexity researcher who described recovered payloads and UTA0576's activity.Yordan GanchevwatchTowr principal threat intelligence specialist who described the vulnerability's root cause.
Threat Actors
Vendors
Products
Tools
Countries
Singaporeas of October 14, 2026. The attack attempts have originated from 50 unique IP addresses geolocated to Singapore and the U.S. Some of the observed IP addresses are listed below -United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version