Honeypots Log 105 Attacks on Ivanti Connect Secure Ahead of CISA Deadline

New Honeypot Data Shows Active Scanning for the Ivanti Connect Secure Chain

A day after Volexity disclosed that threat actor UTA0576 had chained three Ivanti Connect Secure zero-days for unauthenticated root access (covered here), threat intelligence firm Previdian has published new honeypot telemetry showing the exploitation attempts extend well beyond the original disclosure. As of October 14, 2026, Previdian recorded 105 exploitation attempts against its honeypot sensors, originating from 50 unique IP addresses geolocated primarily to Singapore and the United States.

What's New Here

This is a complementary data set, not a restatement of Volexity's findings. Volexity's October 13 report focused on the sophisticated post-exploitation tradecraft of a single threat actor — credential theft, log tampering, evasion of the Integrity Checker Tool. Previdian's honeypot data instead shows the breadth of opportunistic scanning now underway across the wider internet, plus a specific technical detail not covered in the original disclosure: attackers reaching an internal CGI handler via the X-DSCGI-PATH header and uploading Perl scripts disguised as ZIP archives.

The CISA Clock Is Running

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, giving federal civilian agencies until October 16, 2026 — a three-day window — to patch. The honeypot data landing the same week that deadline closes underscores why CISA set it so tight: this is not a theoretical risk window, it's one with measurable, ongoing scanning activity against the exact flaw in question.

Recommendations

1. Patch Ivanti Connect Secure against CVE-2026-104935 now if you haven't already — the October 16 federal deadline is a reasonable bar for any organization running the appliance, not just federal agencies.
2. Hunt for the X-DSCGI-PATH header in ICS access logs as a specific indicator of the scanning technique Previdian documented, in addition to the welcome.cgi indicators Volexity previously published.
3. Watch for ZIP-disguised file uploads targeting the appliance's upload handlers — this is the delivery mechanism observed in the new honeypot data.
4. Remember that the privilege-escalation component of the underlying exploit chain remains unpatched per Volexity's original report — patching CVE-2026-104935 closes the auth-bypass/RCE pair but does not fully close the chain.

Key Takeaways

1. Honeypot firm Previdian logged 105 exploitation attempts from 50 IPs against the Ivanti Connect Secure zero-day chain as of October 14, 2026.
2. The new data reveals a specific technique — abusing the X-DSCGI-PATH header and uploading Perl scripts disguised as ZIP files — not detailed in Volexity's original disclosure.
3. CISA's KEV listing for CVE-2026-104935 carries a three-day federal patch deadline, expiring October 16, 2026.
4. This report supplements, rather than duplicates, the October 13 Volexity findings on threat actor UTA0576's exploitation chain.

Sources

• CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts — The Hacker News