CISA honeypot logs reveal 105 Ivanti exploit attempts in two weeks
Cybersecurity researchers monitoring internet-exposed Ivanti Connect Secure appliances observed 105 exploitation attempts within a two-week window in October 2026. Honeypot data collected by CISA and published on October 14 shows attackers leveraged the authentication bypass flaw CVE-2026-104935 to gain unauthenticated remote code execution on VPN gateways. The campaign coincided with CISA's issuance of an urgent binding directive October 13, pressing federal agencies to patch within a defined window. The number alone, 105, indicates organized scanning rather than isolated probing.
The vulnerability resides in the web management interface of Ivanti Connect Secure appliances. Attackers submitted specially crafted X-DSCGI-PATH HTTP headers that allowed them to bypass the login screen entirely. Once past the authentication gate, the flaw permitted arbitrary command execution at the operating system level. CVSS scoring placed the flaw at 8.6 out of 10, classifying it as critical. Security researchers at Aviatrix documented more than 105 exploitation events and noted that UTA0576, a grouping tracked in threat intelligence, conducted post-exploitation activities that went well beyond initial access.
Who is UTA0576 and why the credential theft matters
Threat intelligence attributed the activity to UTA0576, a grouping that security analysts describe as a financially motivated actor with ties to state-aligned operations. In addition to remote code execution, UTA0576 was observed extracting stored credentials from the Ivanti appliance, harvesting Active Directory metadata, and attempting Kerberos ticket requests via the well-known technique known as Kerberoasting. BitLocker recovery keys were also pulled from compromised systems, a step that could enable full-disk decryption on Windows machines within the same network. CISA's October 13 alert cited evidence of more than 105 distinct exploitation events observed across honeypot deployments. The advisory recommended immediate upgrade to a fixed Ivanti release, noting that affected builds include 22.8R2.4 and lines 25.1.1.1 through 25.1.2.2.
The attack path is methodical. UTA0576 first uses the X-DSCGI-PATH header to reach a restricted CGI handler without credentials. From there, the group escalates to root privileges, pulls stored administrator passwords, and enumerates Active Directory objects through LDAP queries. This is not a spray-and-pray ransomware play; it is sustained intrusion with clear data-theft objectives. Selective log tampering was observed to erase evidence of some commands while leaving enough forensic noise for analysts to identify the intrusion. The technique of partial log deletion is a tell that distinguishes targeted groups from automated exploit kits.
Plex and six new KEV entries added October 20
The same week CISA warned on Ivanti, the agency added six new vulnerabilities to its Known Exploited Vulnerabilities catalog. The additions included four CVEs affecting Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, all relating to server-side request forgery and encoded URI handling. Two other entries, CVE-2026-106931 and CVE-2026-110936, target EG Secure Solutions SiteGuard Server Edition and Siemens Software Center respectively. All six were added based on evidence of active exploitation, not theoretical risk.
The Plex SSRF flaws allow a remote attacker to induce the server to make arbitrary HTTP requests to internal services. Combined, the four vulnerabilities chain into what researchers have called Plex2Shell, a pattern of unauthenticated remote code execution through crafted URI schemes. A single request can trigger a server-side request that reaches an internal service, then pass malicious payloads through encoded URI parameters that the Plex server fails to neutralize. The EG Secure vulnerability, CVE-2026-106931, is an OS command injection that lets unauthenticated attackers execute system commands on the server. Siemens Software Center CVE-2026-110936 involves an uncontrolled search-path element that could permit privilege escalation when a malicious binary is placed in the search path. These are not obscure academic findings; they are practical entry points in products deployed inside home networks and small-business environments.
SafePay ransomware breach tally hits 600 organizations
Separately, a joint advisory from CISA, FBI, USSS and international partners published October 21 documented the SafePay ransomware operation's impact. Since August 2024, SafePay has breached more than 600 critical infrastructure organizations across North America, South America, Europe and Australia. The group gains initial access through credential exposure, brute-force attacks on VPN ports, and phished account profiles, frequently routing traffic through Mullvad VPN IP addresses to obscure origin. After entry, actors perform double-extortion: copying sensitive data before encrypting systems, then threatening public release if ransom demands go unpaid. Recovery is further sabotaged by deliberate deletion of shadow copies and wiping of network-attached storage backups.
Valid credentials bypassed prevention controls in 63 percent of post-access scenarios, according to the advisory. That statistic is the central problem: once an attacker holds a legitimate username and password, perimeter tools often treat the session as trusted. Only 37 percent of post-compromise actions were blocked in environments relying on credential-based trust models. The advisory points to zero-trust segmentation as the most direct countermeasure, along with egress filtering to disrupt data exfiltration before encryption occurs. For Indonesian organizations relying on remote access through VPN appliances, the lesson is direct; the same appliance types targeted by UTA0576 are also targeted by SafePay in the initial access phase.
Regulatory exposure across frameworks
Organizations face compliance consequences beyond immediate incident response. The Ivanti vulnerability implicates controls in PCI DSS 4.0, NYDFS 23 NYCRR 500, DORA and NIS2, particularly around vulnerability management, multi-factor authentication on remote access, and incident notification timelines. SafePay's double-extortion model triggers reporting obligations under NIS2 Article 23, requiring notification to national authorities within 24-72 hours of a material incident. Financial entities subject to PCI 4.0 must demonstrate MFA enforcement on VPN and administrative access under Requirement 8.4, and show timely patching under Requirement 6.3. The overlap is not coincidental; both incidents expose the gap between how security standards are written and how remote access is actually managed in production.
What comes next
Security teams should take four concrete steps in the immediate window. First, inventory all Ivanti Connect Secure appliances and confirm whether they run a patched software release above the affected lines. Second, enforce zero-trust segmentation to limit lateral movement should an appliance be compromised. Third, enable egress filtering and policy enforcement to block unauthorized data transfers that could realize the double-extortion threat. Fourth, enable multicloud visibility and control with anomaly detection to surface the covert command-and-control channels that ransomware operations rely on for coordination.
The pace of vulnerability discovery in 2026 shows no sign of abating. With CISA's KEV catalog growing and honeypot data providing real-time insight into active exploitation, the window for proactive defense narrows. Organizations that delay patching or skip network segmentation do so at the risk of falling into the same categories of incidents already documented in this cycle. It is not clear that this will hold for enterprises that treat VPN appliances as trusted internal infrastructure; the data says otherwise. For desk coverage on related events, see desk coverage. CISA KEV catalog tracks all actively exploited flaws.