CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA directs immediate Ivanti Connect Secure updates due to active exploitation.
Run Ivanti?
Get an email when a reviewed story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
CISA has issued a directive for organizations to immediately update their Ivanti Connect Secure (ICS) appliances. This urgent call comes after the disclosure of a critical authentication bypass vulnerability, CVE-2026-104935, which is being actively exploited. Honeypots have detected over 105 exploit attempts, highlighting the immediate threat.
The lesson from this incident
Full lessonA critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited, with honeypots already logging over 105 attack attempts shortly after public disclosure. This highlights the dangerously narrow window organizations have between vulnerability disclosure and widespread exploitation, particularly for internet-facing remote access appliances. Ivanti VPN gateways are high-value targets because compromising them can grant attackers direct access to internal networks, bypassing perimeter defenses entirely. The speed of exploitation underscores that threat actors monitor vulnerability disclosures closely and weaponize them faster than many organizations can respond. Delayed patching of critical infrastructure — especially remote access systems — represents one of the highest-risk failure modes in enterprise security.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-104935