Changed since version 1

• Added the report of 105 honeypot exploit attempts to the verdict and what happened [S1].
• Set confidence to low: single secondary source whose text was not available for verification [S1].
• Filled Eradicate and Re-enter sections; added a debrief gap on the unverified attempt figure [S1].
• Added open questions on the two undescribed material developments and on confirming the KEV listing from the primary page.

What happened

• An authentication-bypass zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935, is reported exploited since October 1 [S1].
• Honeypots reportedly logged 105 exploit attempts. These are attempts, not confirmed compromises [S1].
• An earlier July fix reportedly addressed the flaw only partially [S1].
• No technical details, artifacts or indicators were available from the source [S1].

Timeline

Detect

Inventory Ivanti Connect Secure log sources · Any syslog or appliance logs forwarded from Ivanti Connect Secure (formerly Pulse Secure)

index=* ("Ivanti" OR "Connect Secure" OR "Pulse Secure") earliest=-30d | stats count min(_time) as first_seen max(_time) as last_seen by host, sourcetype

FROM logs-* | WHERE @timestamp >= NOW() - 30 days AND (message LIKE "*Ivanti*" OR message LIKE "*Connect Secure*" OR message LIKE "*Pulse Secure*") | STATS count = COUNT(*), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY host.name, event.dataset

A hit means: An appliance is sending logs, so it is in scope for patching and log preservation. A hit is a scoping result, not evidence of compromise. No source gives exploit indicators to hunt for.

Verify

• The sources give no exploit artifacts, so a true positive cannot yet be confirmed from logs alone. Use Ivanti's advisory and integrity-check guidance once it is obtained.
• Honeypot-style hits show scanning or exploitation attempts only. Treat them as attempts unless there is evidence of authenticated sessions that were never issued [S1].

Scope

Affected

• Ivanti Connect Secure [S1]

Only if

None stated by the sources.

Not affected if

None stated by the sources.

Enumerate

• All Ivanti Connect Secure appliances, including internet-facing, DR and lab units, with exact build versions.
• Whether each appliance received the July fix, which is reportedly partial [S1].
• VPN sessions and accounts authenticated through these appliances since 2026-10-01.
• Appliance log retention back to 2026-10-01.

Contain

• Preserve appliance logs and system snapshots from 2026-10-01 onward before any change. A reset or reimage cannot be undone and destroys on-box evidence.
• Apply Ivanti's current fix or mitigation as published in the vendor advisory. The July fix alone is reportedly not enough [S1].
• If no fix is available, restrict management and user-portal exposure where business allows, and record the decision.

Eradicate

• The sources describe no persistence mechanism. Follow Ivanti's advisory for integrity checks and rebuild guidance once obtained.
• Remove the root cause by moving off builds that carry only the partial July fix [S1].

Recover

• Before returning an appliance to service, confirm it runs the vendor-stated fixed build.
• After restoring, monitor VPN authentication and admin activity on the appliances for sessions without a matching authentication record.

Re-enter the loop when

• Ivanti publishes or revises an advisory, fixed-build list or mitigation.
• Indicators, exploit artifacts or persistence details are published.
• A primary source confirms successful compromises rather than attempts.
• Another Ivanti product or version range is named as affected.
• Any appliance shows sessions without a matching authentication record.

Debrief

• Record the appliance inventory, build versions, patch dates and log retention.
• Record whether the July fix was applied and when.
• Gap: no vendor primary source in the input.
• Gap: no technical details, indicators or affected and fixed version list in the input.
• Gap: the source text itself was not available; the 105-attempt figure is unverified [S1].

Detection coverage — checked automatically

Checked automatically 2026-11-10 07:59Z from public sources: 9 published, 18 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-104935 — Ivanti Connect Secure auth-bypass CVE-2026-104935 exploited in the wild by UTA0576 since October 3, CISA KEV-listed. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-104935

cpe:"cpe:/a:ivanti:connect_secure"

product:"Connect Secure"

host.services: (software.product = "Connect Secure")

http.title:"Ivanti Connect Secure"

http.title:"Pulse Connect Secure"

product:"Pulse Connect Secure"

ssl:"Pulse Secure"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

Banner spellings: a model read 5 from the NVD names and this card's text (former and marketing names, console titles); 4 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 07:59Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The pipeline flags two material developments on watch, but the story does not describe them. What changed?
• The context cites a CISA KEV listing for CVE-2026-104935; confirm the listing date and due date on the KEV catalog, as it is not among the numbered sources.
• Which Connect Secure versions are affected and which builds are fixed? Confirm from Ivanti's advisory or NVD.
• Are the 105 honeypot hits successful exploitation or only attempts, and who operated the honeypots?
• Has Ivanti confirmed the July fix was partial, and does it attribute the activity?

Sources

• [S1] https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching · darkreading.com

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.