[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYCndzyygUe7PTvq-ciGE4Cu482aBHqCJs9fbK2ketcQ":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"988c8bae-2ed8-4e9f-b332-1078d36717d2","CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts","cisa-urges-immediate-ivanti-connect-secure-updates-as-honeypots-log-105-exploit--13d15f","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS","CISA has issued a directive for organizations to immediately update their Ivanti Connect Secure (ICS) appliances. This urgent call comes after the disclosure of a critical authentication bypass vulnerability, CVE-2026-104935, which is being actively exploited. Honeypots have detected over 105 exploit attempts, highlighting the immediate threat.","CISA directs immediate Ivanti Connect Secure updates due to active exploitation.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcisa-urges-immediate-ivanti-connect.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgBUpsAaH4Pe-HlsDhdSH5KK3VgWm9NEXXLNBOpxxp4d8WMZwSNNyPALzuapR_iUlq3-dLDe2bnPJfh42cdfH5m3LQWGKXZvHF3sYacyDbtZacKIIoluyNgP01-6bjjEz-RBhAQqxw-VHGD7gpn3ToRulgeH0ydeWXOucoK4hLBwvXtlCg81tB1scdjPbKN\u002Fs1600\u002Fi-h.jpg","2026-10-14T12:30:42+00:00","2026-10-14T14:00:09.919683+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":19},"ICS",{"name":26,"type":19},"Connect Secure",{"name":28,"type":19},"appliances",{"name":30,"type":22},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-104935","Actively exploited authentication bypass vulnerability in Ivanti Connect Secure",[21,30,18],{"controls":61,"vendors":145},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":53,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":141,"product_name":142,"url":143,"description":144},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[146],{"slug":147,"name":21,"logo_path":148,"roles":149},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"critical-ivanti-vpn-flaw-actively-exploited-patch-immediately","Critical Ivanti VPN Flaw Actively Exploited — Patch Immediately","A critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited, with honeypots already logging over 105 attack attempts shortly after public disclosure. This highlights the dangerously narrow window organizations have between vulnerability disclosure and widespread exploitation, particularly for internet-facing remote access appliances. Ivanti VPN gateways are high-value targets because compromising them can grant attackers direct access to internal networks, bypassing perimeter defenses entirely. The speed of exploitation underscores that threat actors monitor vulnerability disclosures closely and weaponize them faster than many organizations can respond. Delayed patching of critical infrastructure — especially remote access systems — represents one of the highest-risk failure modes in enterprise security.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL Problem Management: Proactive Problem Identification","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]