The Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 13 added a chained high-severity Ivanti Connect Secure (ICS) flaw to its known exploited vulnerabilities (KEV) catalog and gave federal agencies until Oct. 16 to make the patch.
Security pros told teams to take the matter seriously, especially since as of this afternoon, Previdian disclosed that it observed 108 exploitation attempts of the ICS flaw targeting its honeypots. The researchers said the attempts originated from 50 unique IP addresses geolocated to Singapore and the United States.
Along with the Previdian information, Volexity reported Oct. 13 that in the first week of October it observed an undisclosed threat actor compromise a fully patched ICS VPN device. The researchers said the attacker's exploit chain combined an authentication bypass, a remote code execution (RCE), and a third flaw — a privilege escalation vulnerability — to achieve unauthenticated root-level code execution.
The bug added to the KEV — CVE-2026-104935 — was described as an authentication bypass by spoofing vulnerability that lets a remote unauthenticated attacker execute arbitrary commands. The privileged escalation flaw reported by Volexity does not yet have a patch — and has not been added to the KEV.
“The reported exploitation attempts imply attackers are actively testing these vulnerabilities,” said Andi Ursry, threat intelligence analyst at Blackpoint Cyber. “Organizations should prioritize applying the available patches, applying the new patches as soon as they are available, and review the environment for potential compromise, especially since the available reporting suggests the activity can evade traditional integrity checks.”
Justin Moore, director of adversary operations at Arctic Wolf, said organizations should patch now, but it’s only half the job. Moore explained that Ivanti fixed two of the three flaws, and the privilege escalation fix will come later.
“CISA has also said that confirming compromise requires network and memory forensics,” said Moore. “A clean scan from the vendor's own tool is not proof of a clean appliance.”
Robert Costello, chief digital and information officer at the Merlin Group, said Ivanti Connect Secure edge devices sit at critical points in enterprise networks, delivering important protections, but they may also have significant access, which limits visibility.
“Attackers are now increasingly using AI to accelerate vulnerability discovery, automate exploit development, and scale reconnaissance across exposed systems,” said Costello. “That makes it easier to chain vulnerabilities together, turning an authentication bypass into remote code execution and privilege escalation. These aren’t always isolated issues, and the combined risk can be far greater than any single vulnerability.”
Costello said CISA’s guidance on securing edge devices and BOD 26-04 offers a good model — and not just for federal agencies. State and local governments, critical infrastructure operators, and the private sector should look to the same approach: know what’s exposed, prioritize vulnerabilities being actively exploited, reduce unnecessary access, and improve monitoring.
“Critical protections are important, incorporate zero-trust throughout systems, not just at the edge,” said Costello. “Organizations need to concentrate their efforts where the risk is greatest, especially as AI enables attackers to move faster and operate at greater scale.”
