What happened

• An authentication-bypass zero-day in Ivanti Connect Secure is tracked as CVE-2026-104935 [S1].
• Exploitation is reported to have begun on October 1 [S1].
• Honeypots logged 105 exploit attempts. These are attempts, not confirmed compromises [S1].
• The flaw was reportedly only partly patched by an earlier July fix [S1].
• The input contains no technical behaviors, artifacts or indicators [S1].

Timeline

Detect

Inventory Ivanti Connect Secure log sources · Any syslog or appliance logs forwarded from Ivanti Connect Secure (formerly Pulse Secure)

index=* ("Ivanti" OR "Connect Secure" OR "Pulse Secure") earliest=-30d | stats count min(_time) as first_seen max(_time) as last_seen by host, sourcetype

A hit means: An appliance is sending logs, so it is in scope for patching and log preservation. A hit is a scoping result, not evidence of compromise. No source gives exploit indicators to hunt for.

Verify

• The sources give no exploit artifacts, so a true positive cannot yet be confirmed from logs alone. Use Ivanti's advisory and integrity-check guidance once it is obtained.
• Honeypot attempts show scanning or exploitation attempts only. Treat them as attempts unless there is evidence of authenticated sessions that were never issued [S1].

Scope

Affected

• Ivanti Connect Secure [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

• All Ivanti Connect Secure appliances, including internet-facing, DR and lab units, with exact build versions.
• Whether each appliance received the July fix, which is reportedly partial [S1].
• VPN sessions and accounts authenticated through these appliances since 2026-10-01.
• Appliance log retention back to 2026-10-01.

Contain

• Preserve appliance logs and system snapshots from 2026-10-01 onward before any change. A reset or reimage cannot be undone and destroys on-box evidence.
• Apply Ivanti's current fix or mitigation as published in the vendor advisory. The July fix alone is reportedly not enough [S1].
• If no fix is available, restrict management and user-portal exposure where business allows, and record the decision.

Eradicate

• The sources do not describe persistence or post-exploitation activity. Follow Ivanti's advisory once obtained.

Recover

• Before returning an appliance to service, confirm it runs the vendor-stated fixed build.
• After restoring, monitor VPN authentication and admin activity on the appliances for sessions without a matching authentication record.

Re-enter the loop when

• Ivanti publishes or revises an advisory, fixed builds or mitigations for CVE-2026-104935.
• IoCs, exploit artifacts or attacker infrastructure are published.
• Reports move from exploit attempts to confirmed compromises or post-exploitation activity.
• Other Ivanti products are reported affected.

Debrief

• Record the appliance inventory, build versions, patch dates and log retention.
• Record whether the July fix was applied and when.
• Gap: no vendor primary source in the input.
• Gap: no technical details, indicators or affected and fixed version list in the input.

Detection coverage — checked automatically

Checked automatically 2026-10-31 22:22Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

vuln:CVE-2026-104935

cpe:"cpe:/a:ivanti:connect_secure"

product:"Connect Secure"

host.services: (software.product = "Connect Secure")

http.title:"Ivanti Connect Secure"

http.title:"Pulse Connect Secure"

product:"Pulse Connect Secure"

http.html:"Pulse Connect Secure"

ssl:"Pulse Secure"

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 5 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• What do Ivanti's advisory and fixed builds say about CVE-2026-104935?
• Is CVE-2026-104935 on CISA KEV? The context says so, but no source in the input confirms it.
• Which Connect Secure versions are affected, and what did the July fix change?
• Are there confirmed compromises beyond the 105 honeypot attempts, and are there IoCs?
• Who is the reported threat actor, if any?
• The CVE number format is unusual; verify it against NVD or Ivanti.

Sources

• [S1] https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching · darkreading.com

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.