Cybersecurity
CISA urges Ivanti Connect Secure patching
CISA told organisations using Ivanti Connect Secure to install the latest release after disclosure of an authentication-bypass flaw, while Previdian said honeypots recorded 105 exploitation attempts from 50 IP addresses.
- CISA said CVE-2026-104935 affected Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and could let an unauthenticated remote attacker execute commands.
- The agency said it knew of threat actors using the zero-day to steal credentials and exfiltrate data, and it added the issue to its Known Exploited Vulnerabilities catalogue for Federal Civilian Executive Branch agencies to fix by October 16, 2026.
- Previdian said its honeypots recorded 105 attempts by October 14, 2026, from 50 IP addresses geolocated to Singapore and the U.S.
- Volexity said it first saw exploitation on October 3, 2026, and attributed it to UTA0576, which it said used the flaw with a privilege-escalation issue to gain root-level code execution.
- Ryan Dewhurst said attackers were using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files, while watchTowr said a single crafted request could bypass authentication.
CISA said on Tuesday that organisations should update Ivanti Connect Secure immediately after disclosure of CVE-2026-104935. It said the flaw affected versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and could let an unauthenticated attacker execute commands remotely.
The agency said it knew of attackers using the issue to steal credentials and take data. It added the vulnerability to its Known Exploited Vulnerabilities catalogue and said Federal Civilian Executive Branch agencies had to apply fixes by October 16, 2026; it also noted that version 22.8 was due to reach end of life on January 31, 2027.
CISA told operators to review Ivanti's upgrade and migration guidance and to check appliances for signs of compromise using network and memory analysis. If compromise was found, it advised backing up the configuration, rebuilding or resetting the appliance, restoring the saved configuration, and resetting passwords, certificates, API keys and licence credentials.
Previdian said its honeypots had recorded 105 exploitation attempts by October 14, 2026, from 50 IP addresses geolocated to Singapore and the U.S. Ryan Dewhurst said the traffic used an X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts that posed as ZIP files, and he said the captured payloads were mainly checking whether code execution worked.
Volexity said it first saw exploitation on October 3, 2026, and attributed it to a threat actor it called UTA0576, which it said used the flaw together with a privilege-escalation bug to reach root-level code execution. The firm said the actor collected stored credentials and limited Active Directory metadata, ran a Kerberoasting tool, carried out host reconnaissance and LDAP packet capture, and modified logs; Defused Cyber said its decoys saw pre-disclosure activity from October 1, and watchTowr said a single crafted header request could bypass authentication.
Named in this story
People
- Ryan Dewhurst
- Previdian founder and chief executive who described the attack method
- Yordan Ganchev
- watchTowr principal threat intelligence specialist who described the request pattern
- Charlie Gardner
- Volexity researcher who described the recovered payloads and log tampering
- Sean Koessel
- Volexity researcher who described the recovered payloads and log tampering
- Steven Adair
- Volexity researcher who described the recovered payloads and log tampering
Companies
- Ivanti
- made Connect Secure and the guidance CISA cited
- Previdian
- said its honeypots logged 105 exploitation attempts
- Volexity
- said it first saw exploitation on October 3, 2026
- Defused Cyber
- said its decoys saw pre-disclosure exploitation
- watchTowr
- commented on how the flaw could be triggered
Organisations
- UTA0576
- the threat actor Volexity linked to the exploitation
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- urged immediate patching and added the flaw to its exploitation list
- Federal Civilian Executive Branch agencies
- had to apply fixes by October 16, 2026
Products and systems
- Ivanti Connect Secure
- the affected appliance and software platform
Places
- Singapore
- one of the places where attack IPs were geolocated
- United States
- one of the places where attack IPs were geolocated
How the source tells it
The piece was written as a security warning, with urgency supplied by repeated calls to patch and by attributed claims of active exploitation and likely follow-on attacks.
- urgency repeated directives for immediate updating and fixed remediation deadlines
- threat references to active exploitation, credential theft and compromise checks
- speculation predictive statements about near-term weaponisation and rapid wider abuse