CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

CISA has urged immediate updates to Ivanti Connect Secure (ICS) appliances due to active exploitation of a critical authentication bypass vulnerability, CVE-2026-104935, which allows unauthenticated remote code execution. The flaw affects multiple ICS versions and is being exploited in the wild, with honeypots detecting 105 exploit attempts originating from 50 unique IP addresses. Threat actor UTA0576 has been observed leveraging the vulnerability in conjunction with a privilege escalation flaw to achieve root-level access, conduct credential theft, exfiltrate Active Directory metadata, and deploy tools for Kerberoast attacks and LDAP reconnaissance.

AI-extracted · verify before operational use