CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

1. Executive summary

Ivanti Connect Secure (ICS) is being exploited in the wild through CVE-2026-104935, an authentication bypass by spoofing (CWE-290) rated CVSS 8.6 HIGH, which lets a remote unauthenticated attacker execute arbitrary commands on the appliance. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-13 with a remediation due date of 2026-10-16, and EPSS sits at 26%. Volexity tracked the activity to an actor it designates UTA0576, which chained the bypass with a remote code execution flaw and a separate, still-unpatched privilege escalation bug to reach root on a fully patched 22.8R2.4 appliance, then deleted its own debug and audit logs. For EMEA financial services, ICS is an internet-facing edge device that brokers VPN access into the corporate network, so a successful compromise puts Active Directory credentials, LAPS passwords and BitLocker recovery keys within reach of the attacker.

2. Regulatory framing

3. Technical analysis & attack chain

The chain was observed against a fully patched ICS appliance running 22.8R2.4, Build 19097. Volexity began investigating suspected malicious activity at a Network Security Monitoring customer on 2026-10-05 and traced the root cause to the ICS VPN appliance. Exploitation started on 2026-10-03.

Confirmed steps, in the order Volexity reconstructed them:

1. UTA0576 sends requests that abuse how the ICS appliance routes requests from front-end and back-end processes to a CGI script handler. This is the authentication bypass component.
2. The remote code execution component is reached through wu.cgi. Ivanti tracks both the bypass and the RCE under CVE-2026-104935.
3. Through the RCE, the actor uploads and executes a Perl script. The Perl script executes a Bash script, which in turn executes a Python script.
4. The Python script is delivered Base64-encoded and zlib-compressed. It is decompressed, decoded and run via exec(), so the raw script exists only in memory and never touches disk.
5. The Python script carries a separate privilege escalation exploit, passed in memory, which takes the actor from code execution as the cgi-server user to root. This privilege escalation vulnerability was unpatched at the time of Volexity's reporting, and Ivanti planned to patch it at a later date.
6. For every command the actor runs, the entire exploit chain is re-executed. Command results are returned inside the exploit chain's HTTPS requests.

Post-exploitation, the actor targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys. It deleted evidence of exploitation from Ivanti debug logs and Linux audit logs, which is why forensic analysis of memory and disk images, plus core dumps generated during exploitation, was needed to reconstruct the chain. No backdoor and no web shell were deployed to the appliance, and the actor did not stand up a separate command-and-control channel: commands and results travelled inside the exploit chain's own HTTPS traffic.

Affected and resolved versions, per Ivanti:

Versions 22.7.x and below are unaffected. Ivanti states that a portion of the vulnerability was found through its product security program and patched in the July 2026 release of 25.1.3.0; exploitation occurred while the vendor was backporting the fix to the remaining supported versions. The fix for the RCE and bypass components shipped on 2026-10-13.

Confidence caveats. The exploit chain reconstruction, the UTA0576 designation and the post-exploitation detail on LAPS passwords and BitLocker recovery keys all come from a single source, Volexity's blog post. UTA0576 has no MITRE ATT&CK profile in the reference data supplied with this advisory, so the attribution is unconfirmed and the actor should be treated as an unidentified cluster until corroborated. Ivanti itself stated at the time of its advisory that reliable indicators of compromise were not available, which conflicts with Volexity having published several; treat Volexity's indicators as the only available set and verify before enforcement. The privilege escalation vulnerability in the chain is unpatched, so patching CVE-2026-104935 does not close the full chain on its own.

4. Mitigation & containment

P1, within 24 hours:

• Upgrade every internet-facing ICS appliance to a resolved version: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5, matching the code line in use. Do this outside the normal patch cycle. CISA's remediation due date is 2026-10-16.
• Hunt for compromise on every ICS appliance, patched or not. Volexity's finding is that the actor wiped Ivanti debug logs and Linux audit logs, so log review alone will miss this. Capture memory and disk images from any appliance with suspected activity and analyse core dumps generated during exploitation.
• Treat any ICS appliance showing signs of compromise as a breach, not a patching task. Volexity's guidance is that systems showing signs of compromise, such as lateral movement originating from the ICS device, should be forensically investigated. Follow Ivanti's recovery steps for suspected exploitation.
• Rotate credentials reachable from the appliance: Active Directory service and privileged accounts, LAPS-managed local administrator passwords, and BitLocker recovery keys. The actor specifically targeted these.

P2, within 72 hours:

• Because the privilege escalation component of the chain was unpatched at the time of reporting, do not treat the ICS upgrade as closing the chain. Track Ivanti's advisory for the privilege escalation fix and apply it when released.
• Restrict management and administrative access to ICS appliances to dedicated administrative networks or jump hosts, and review which internal systems the appliance can reach.
• Review ICS access logs for authentication events that do not map to a known user or session, given the bypass is an authentication spoofing flaw (CWE-290).

P3, within 7 days:

• Add ICS appliances to an inventory that records firmware version, code line and last upgrade date, so the next edge-device advisory can be triaged against known versions rather than discovered during an incident.
• Confirm that forensic capture of edge appliances is a rehearsed capability. This incident required memory and disk images plus core dumps to reconstruct, because the actor removed the logs.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. Volexity states it published several, but the specific values are not present in the sources supplied with this advisory, and Ivanti stated at the time of its advisory that reliable indicators were not available. The behavioural indicators below are drawn from Volexity's reconstruction and are single-sourced; verify before enforcement.

Behavioural indicators

6. Detection

The sources give no file hashes, filenames, registry keys or hard-coded strings from the malicious tooling. The only named artefacts are the CGI script wu.cgi and the script interpreter chain (Perl, Bash, Python), which are legitimate components of the product and would generate false positives if used as detection strings. No YARA rule is emitted.

A Sigma rule is possible for the log-deletion behaviour, which is the one observable that survives on a system where the actor has removed its own traces. It is behavioural and will require tuning.

title: Ivanti Connect Secure Debug and Audit Log Deletion
id: 8f2c1a44-6b7e-4d19-9c3a-2e5f7a0b1d92
status: experimental
description: Detects deletion of Ivanti debug logs and Linux audit logs on an Ivanti Connect Secure appliance, a post-exploitation action observed in the CVE-2026-104935 exploit chain.
author: Adverse Trace
date: 2026-10-14
references:

  - https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
  - https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935
logsource:
  product: linux
  service: auditd
detection:
  selection_audit:
    type: 'DEL'
    path|contains:

      - '/var/log/audit/'
  selection_debug:
    type: 'DEL'
    path|contains:

      - '/var/log/'
      - 'debug'
  condition: selection_audit or selection_debug
falsepositives:

  - Log rotation or administrative cleanup on the appliance
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• The Hacker News, CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts, https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html, 2026-10-14
• NVD / CISA Known Exploited Vulnerabilities, CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-104935
• Rapid7, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13
• Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/, 2026-10-13
• The Record (Recorded Future), CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records, https://therecord.media/new-ivanti-microsoft-bugs-exploitation

8. Adverse Trace position

CVE-2026-104935 is CVSS 8.6 HIGH, in CISA KEV since 2026-10-13, with EPSS at 26% and a CISA remediation due date of 2026-10-16. The severity is high rather than critical, but the exploitation state and the unauthenticated remote code execution on an internet-facing VPN appliance put it at the top of our client action list for this week. The chain as reconstructed by Volexity is single-sourced and the actor designation UTA0576 has no MITRE ATT&CK profile in our reference data, so we treat the attribution as unconfirmed; the exploitation itself is corroborated by Ivanti, CISA and Rapid7. The material risk to EMEA clients is not the appliance but what sits behind it: LAPS passwords and BitLocker recovery keys were the stated targets, and the actor removed the logs that would normally show the intrusion. We will track Ivanti's advisory for the outstanding privilege escalation fix, since patching CVE-2026-104935 does not close the chain, and we will update this advisory if Volexity's published indicators become available to us for verification.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.