CISA Issues Urgent Warning Over Actively Exploited Ivanti Connect Secure Zero-Day Vulnerability

The scale of the threat was further illuminated by data from the cybersecurity firm Previdian, which disclosed that its global network of honeypot sensors had already begun picking up exploitation attempts. As of October 14, 2026, Previdian observed 105 distinct exploitation attempts originating from 50 unique IP addresses. These attack sources have been geolocated primarily to Singapore and the United States, suggesting a distributed infrastructure being used by the attackers to mask their true origins.

Ryan Dewhurst, the founder and CEO of Previdian, provided a technical breakdown of how the exploit is being carried out in the wild. According to Dewhurst, threat actors are utilizing a specific header, identified as X-DSCGI-PATH, to interact with an internal Common Gateway Interface (CGI) handler on the Ivanti appliance. By manipulating this header, attackers can bypass the authentication gate and upload malicious Perl scripts. In a tactical move designed to evade basic security filters, these scripts are frequently "dressed up" as ZIP files.

Once the scripts are successfully uploaded and executed, they are designed to return unique markers to the attacker’s command-and-control server. These markers serve as a confirmation, informing the threat actor whether the remote code execution was successful and whether the system is ripe for further exploitation. Dewhurst noted that while the attempts captured by Previdian’s sensors so far appear to be primarily testing for code execution rather than deploying heavy payloads, this is often the precursor to a much larger assault. He warned that full weaponized exploitation, involving the deployment of ransomware or sophisticated backdoors, is likely to follow in the coming hours and days as attackers refine their scripts.

The timeline of the attacks appears to stretch back further than initially suspected. In a separate technical report, the cybersecurity firm Volexity revealed that it first observed the exploitation of CVE-2026-104935 on October 3, 2026. Volexity has attributed this early activity to a previously undocumented threat actor it has designated as UTA0576. According to their analysis, UTA0576 is a sophisticated group that leveraged the authentication bypass in conjunction with a separate privilege escalation vulnerability. This "exploit chain" allowed the attackers to transition from unauthenticated access to full, root-level code execution on the ICS VPN appliance.

Volexity’s assessment suggests that UTA0576 is driven by criminal motives—such as financial gain or data theft for extortion—rather than traditional state-sponsored espionage. Despite the criminal focus, the group’s post-exploitation tactics are highly disciplined. After gaining root access, the actor engaged in a wide array of malicious activities designed to compromise the broader corporate network. This included extracting credentials stored directly on the VPN appliance and exfiltrating metadata from the organization’s Active Directory (AD) environment.