CISA Urges Immediate Patching of Ivanti Connect Secure After 105 Exploit Attempts Detected

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory for organizations to update their Ivanti Connect Secure (ICS) appliances, following the disclosure of an actively exploited authentication bypass vulnerability. Tracked as CVE-2026-104935 with a CVSS score of 8.6, the flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to vulnerable systems. According to honeypot data, at least 105 exploit attempts have been logged, underscoring the immediate risk to unpatched deployments.

Vulnerability Details

CVE-2026-104935 is classified as an authentication bypass affecting Ivanti Connect Secure. With a CVSS score of 8.6, it is considered high severity. Successful exploitation could enable an attacker to circumvent login controls, potentially leading to full compromise of the appliance and lateral movement within the network. While technical specifics remain limited, the active exploitation in the wild signals that adversaries are already weaponizing the flaw.

CISA's Directive and Recommended Actions

CISA's advisory, released on Tuesday, urges all organizations using Ivanti Connect Secure to apply the latest updates without delay. The agency emphasizes that this is not a theoretical threat—honeypots have recorded 105 exploit attempts, indicating scanning and exploitation activity is ongoing. CISA recommends the following steps:

• Immediately update Ivanti Connect Secure appliances to the latest version provided by Ivanti.
• If immediate patching is not possible, consider temporarily disconnecting the appliance from the internet or restricting access to trusted IP ranges.
• Monitor for signs of compromise, including unusual authentication logs, unexpected administrative actions, or outbound connections to unknown hosts.
• Apply network segmentation to limit the blast radius if an appliance is compromised.
• Review Ivanti's security advisory for additional mitigations and indicators of compromise.

Exploitation Activity

The 105 exploit attempts recorded by honeypots suggest that attackers are actively probing for vulnerable instances. This pattern is consistent with previous campaigns targeting edge devices, where threat actors quickly incorporate new vulnerabilities into their scanning and exploitation toolkits. While no specific threat actor has been attributed yet, the speed of exploitation highlights the need for urgent action. Organizations should assume that unpatched systems are being targeted and act accordingly.

Why This Matters

Ivanti Connect Secure is widely used as a VPN and remote access gateway, making it a high-value target for attackers. A successful authentication bypass can provide a foothold into corporate networks, enabling data theft, ransomware deployment, or further intrusion. The fact that CISA has intervened directly indicates the severity and urgency of the situation. Past vulnerabilities in similar products have been exploited by ransomware groups and state-sponsored actors, so the potential impact is significant.

Mitigation and Long-Term Measures

Beyond immediate patching, organizations should adopt a defense-in-depth approach. This includes:

• Continuous monitoring: Implement logging and alerting for authentication anomalies and unusual network traffic.
• Least privilege: Ensure that appliances do not have excessive permissions and that administrative access is tightly controlled.
• Regular patching cadence: Establish a routine for promptly applying security updates to all edge devices.
• Threat hunting: Proactively search for indicators of compromise associated with this vulnerability.

Conclusion

The disclosure of CVE-2026-104935 and the subsequent exploitation attempts serve as a stark reminder of the risks posed by unpatched edge devices. CISA's urgent call to action should be heeded immediately. Organizations that fail to update their Ivanti Connect Secure appliances are leaving themselves exposed to a known, actively exploited vulnerability. Given the high CVSS score and the observed exploitation activity, time is of the essence. Security teams should prioritize patching, verify that no compromise has occurred, and reinforce their overall security posture to prevent future incidents.

For more details, refer to the original advisory from The Hacker News: CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts.