CISA: 105 Attacks Confirm Ivanti Patch Is Urgent
CISA cites 105 honeypot-logged exploit attempts and urges immediate patching of CVE-2026-104935 in Ivanti Connect Secure. Oct 16 deadline is 24 hours out.
Marisol "Fuse" DelgadoThe October 16 deadline for CVE-2026-104935 in Ivanti Connect Secure is 24 hours away. CISA reinforced that message Tuesday with something more concrete: honeypots logged 105 exploitation attempts against the flaw, according to The Hacker News.
Patch now, or document why you can’t.
What’s new
Security researchers’ honeypots logged 105 exploitation attempts against vulnerable Ivanti Connect Secure instances, as reported by The Hacker News. That’s not speculation about attacker interest; it’s a headcount of active probes hitting unpatched appliances in the field.
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13 with a mandatory federal remediation deadline of October 16 under BOD 26-04. Tuesday’s advisory used sharper language and included the honeypot count, but the deadline is unchanged.
BleepingComputer has additional exploitation details.
The patch gap problem
Dark Reading reported that CVE-2026-104935 was only partially identified and addressed in a July patch, leaving an opening that attackers capitalized on. The full authentication bypass, classified as CWE-290 with a CVSS score of 8.6, wasn’t fully patched until Ivanti’s October advisory.
That gap matters for a practical reason: organizations that applied the July patch may believe they’re covered when they’re not. Verify your installed version against the remediated builds in Ivanti’s October security advisory directly. Don’t assume; check.
What to do
Patch to the version listed in Ivanti’s October 13 advisory. If Connect Secure can’t be patched by October 16, CISA’s BOD 26-04 guidance applies: document the exception and isolate the product until the fix can be applied.
If you’re a federal agency, the deadline is not advisory.
Related coverage
- Ivanti Connect Secure Zero-Day Exploited, Fix By Oct 16: the original KEV addition report
- Citrix, Fortinet, and Ivanti October Patch Roundup: broader October patch context
- Inside Ivanti Connect Secure’s Chained Zero-Days: background on the full attack chain this flaw is part of
- [ HIGH ]CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing
Found this useful? Share it.
