105 exploitation attempts have targeted Ivanti Connect Secure honeypots as of October 14, 2026, a sharp signal that a recently disclosed authentication‑bypass bug is being probed widely and at speed.
CVE-2026-104935: the vulnerability and affected Ivanti versions
The flaw, tracked as CVE-2026-104935 and rated CVSS 8.6, is an authentication‑bypass vulnerability in Ivanti Connect Secure (ICS) appliances that can allow a remote, unauthenticated attacker to execute arbitrary commands. The vendor versions named in advisories are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The agency warned this is a zero‑day condition and that threat actors are actively exploiting it.
CISA advisory, KEV listing, and timeline for federal agencies
On Tuesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to immediately update affected ICS deployments to the latest Ivanti versions. The agency added CVE‑2026‑104935 to its Known Exploited Vulnerabilities (KEV) catalog and set a fix requirement for Federal Civilian Executive Branch (FCEB) agencies: apply the fixes by October 16, 2026.
CISA also recommended that customers consult Ivanti's Connect Secure Upgrade and Migration Compatibility Guide for patching instructions, and cautioned that version 22.8 reaches end‑of‑life on January 31, 2027. The agency said, "Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadPrevidian honeypots: 105 attempts, 50 IPs, early payload testing
Security company Previdian reported 105 exploitation attempts against its honeypot sensors as of October 14, 2026. The attempts originated from 50 unique IP addresses geolocated to Singapore and the United States. Previdian published several observed IPs, including:
- 216.73.160[.]59
- 216.73.160[.]61
- 216.73.160[.]210
- 45.8.19[.]111
Previdian founder and CEO Ryan Dewhurst told The Hacker News that attackers are using the X-DSCGI-PATH header to reach an internal CGI handler and upload Perl scripts disguised as ZIP files. He described the scripts as returning unique markers to indicate whether remote code execution succeeded, and warned: "We're seeing coordinated attempts to exploit this Ivanti vulnerability, but the payloads captured so far are primarily testing for code execution rather than deploying malware, or compromising the device. However, full weaponized exploitation is likely to follow in the coming hours and days."
Volexity: early exploitation, UTA0576, and post‑exploit activity
In a separate report, Volexity said it first observed exploitation of CVE‑2026‑104935 on October 3, 2026. The vendor attributed activity to a previously undocumented actor it labeled UTA0576, which used this vulnerability together with a privilege‑escalation flaw to achieve unauthenticated root‑level code execution. Volexity assessed UTA0576 as criminally motivated rather than espionage‑driven.
According to Volexity researchers Charlie Gardner, Sean Koessel, and Steven Adair, successful exploitation led to extensive post‑exploitation actions: extracting credentials stored on the ICS VPN appliance; exfiltrating limited Active Directory metadata; deploying a Kerberos tool capable of Kerberoast attacks and credential testing; conducting host reconnaissance and LDAP packet capture; and dropping a Python LDAP tool to search for administrator passwords and BitLocker recovery keys. The researchers said, "The recovered payloads demonstrate deliberate efforts to conceal malicious activity through selective log modification, removal of temporary execution artifacts, and restoration of altered system state."
What this means for FCEB agencies, affected enterprises, and security teams
Federal Civilian Executive Branch (FCEB) agencies: With a KEV deadline of October 16, 2026, agencies must apply fixes promptly. CISA's explicit remediation checklist and the KEV requirement make timely patching and forensic readiness an immediate compliance and operational priority.
Affected enterprises and Ivanti customers: Organizations running listed ICS versions must prioritize upgrades, especially given Ivanti's guidance that 22.8 is nearing end‑of‑life on January 31, 2027. Customers should consult Ivanti's Upgrade and Migration Compatibility Guide to avoid upgrade missteps.
Security teams and incident responders: CISA advised that determining compromise requires network and memory forensics. If a compromise is detected, the agency recommends the following actions:
- Create a backup of the appliance configuration.
- Conduct a factory reset and upgrade the appliance to the latest version.
- For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
- Restore the appliance configuration from the backup.
- Reset passwords for all accounts, including domain, administrator, and local accounts; revoke and reissue stored certificates; reset stored API keys and license server credentials.
The factual arc of this episode is clear: public reporting shows exploitation observed as early as October 3, 2026, large‑scale probing recorded on honeypots by October 14, 2026, and an imminent federal remediation deadline of October 16, 2026. With Volexity documenting real post‑exploitation operations and Previdian warning of likely weaponization, organizations with impacted Ivanti Connect Secure deployments face a compressed window to patch, validate, and forensically examine systems before more destructive or persistent attacks proliferate.
