Ivanti

ivanti.com

ACKNOWLEDGED

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

Observable Status ACKNOWLEDGED

Industry / Sector Technology & Commercial

Incident Classification Network Intrusion & Data Exfiltration

Attributed Threat Actor Unattributed / Unknown

Affected Population Scope Under Audit

First Seen 2026-10-13

Last Updated 2026-10-31

Compromised Data Classes:

Authentication Credentials

Target Vendor Security Bulletins:

Ivanti: CISA Urges Immediate Ivanti Connect Secure Updates as Honeyp Ivanti: Ivanti patches Connect Secure zero-day after researchers con

OPEN WEIGHTS TELEMETRY • DETERMINISTIC CONFIDENCE

Confidence & Source Corroboration

100% CONFIDENCE

1. Primary Authority GOVERNMENT ADVISORY Base weight: 62%

2. Evidence Specificity +15% Vendor Advisory Verified

3. Corroboration Curve +25% 9 independent domains

4. Timeline & Staleness +5% 12 milestones logged

Corroborated Source Domains:

bleepingcomputer.com securityweek.com cyberscoop.com securityaffairs.com helpnetsecurity.com thehackernews.com hipaajournal.com theregister.com darkreading.com

OFFICIAL VENDOR SECURITY BULLETINS

Target Vendor Technical Disclosures & Patch Bulletins

2 Vendor Bulletins

Vendor Technical Ground Truth: The disclosures below represent official security bulletins and CVE advisories published directly by the affected vendor or target organization. They define authoritative vulnerability scopes, CVSS severity metrics, affected software builds, fixed packages, and mitigation workarounds.

Ivanti

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

CONFIRMED BY TARGET / VENDOR

Bulletin Identifier CISA Urges Immediate Ivanti Connect Secure Updates as Honeyp

Release / Patch Date 2026-10-14

Vendor Severity Rating Critical

Primary Evidence Tier Target Technical Ground Truth

Disclosed CVE Identifiers:

CVE-2026-104935

Technical Vulnerability Overview:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS

View Official Vendor Security Bulletin https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html

Ivanti

Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

CONFIRMED BY TARGET / VENDOR

Bulletin Identifier Ivanti patches Connect Secure zero-day after researchers con

Release / Patch Date 2026-10-14

Vendor Severity Rating Critical

Primary Evidence Tier Target Technical Ground Truth

Technical Vulnerability Overview:

Vendor promises fix for separate privilege-escalation flaw in the coming weeks

View Official Vendor Security Bulletin https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095

Technical Forensic Briefing

Incident Overview

Ivanti, within its operating sector, has been subject to a cybersecurity incident. Ground-truth telemetry indicates the threat activity is currently unconfirmed or under forensic attribution.

Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

Compromised Assets & Data Scope

The specific volume of affected customer or organizational records remains under active forensic investigation. Primary affected online infrastructure and perimeter domains include ivanti.com.

Specific classes of compromised records, credentials, or proprietary information continue to be audited through ongoing forensic investigation.

Authoritative Directives & Vendor Disclosures

Continuous Telemetry Monitoring: Formal statutory regulatory filings (SEC Form 8-K, State AG portals) and sovereign agency advisories (CISA, NCSC) are continuously monitored via automated ingestion pipeline.

Milestone Timeline (12 events logged)

2026-10-13 15:45 UTC

INDEPENDENT VERIFICATION

Ivanti warns of Connect Secure zero-day exploited in attacks

Source: BleepingComputer Report

2026-10-13 18:43 UTC