The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday called on organisations to update their Ivanti Connect Secure (ICS) appliances and deployments immediately, following disclosure of an actively exploited authentication bypass tracked as CVE-2026-104935 and scored 8.6 on the CVSS scale.
The flaw, which allows an attacker to circumvent authentication on affected ICS deployments, is already being exploited in the wild. Honeypot telemetry has recorded 105 exploit attempts against the vulnerability — a figure defenders should read as a floor rather than a ceiling. Honeypots tend to capture opportunistic, low-sophistication scanning; more targeted intrusion sets may well have reached vulnerable appliances earlier without registering on the same sensors.
A note on terminology: "ICS" here refers to Ivanti Connect Secure, the widely deployed remote-access VPN product — not industrial control systems.
Why This Bug Deserves Priority
Authentication bypasses in VPN appliances sit near the top of the risk hierarchy for defenders. These devices are, by design, internet-facing and high-trust: a foothold obtained by defeating login looks legitimate from inside the network, giving attackers a clean path to lateral movement without immediately raising alarms. That combination of external exposure and privileged function is precisely why CISA attached an expedited remediation requirement rather than issuing a routine advisory.
The decision also carries institutional memory. Ivanti appliance vulnerabilities have previously served as an initial-access vector in campaigns attributed to suspected Chinese state actors, including high-profile intrusions into U.S. federal networks. Organisations should assume a comparable playbook is already in motion: probe broadly, prioritise unpatched units, then establish persistence quietly.
What To Do Now
The operational risk here lies not in the difficulty of the fix but in the gap between patch cycle and breach — a gap that, for opportunistic attacks, is measured in hours. A practical response checklist:
- Inventory first. Identify every internet-facing ICS appliance in the fleet, including branch-office and legacy units that tend to escape change-management records.
- Update immediately. Move affected deployments to the latest version per Ivanti's patch notes.
- Run vendor tooling. Execute Ivanti's integrity and external exposure checker utilities on all appliances.
- Rotate credentials. Treat all appliance-local and downstream authentication material as potentially compromised.
- Hunt for persistence. Look for webshells, rogue administrative accounts, unauthorised configuration changes, and unexplained outbound connections.
- Rebuild where compromise is suspected. Factory-reset and restore from known-good backups rather than attempting to surgically remove an intruder.
Full remediation guidance is available in CISA's advisory.
For any organisation running remote-access VPN hardware — not only Ivanti customers — the wider lesson is inventory hygiene. The fleets most at risk are usually the appliances nobody remembered they owned. This story will be updated as Ivanti or CISA publish further technical detail.
美國網絡安全及基礎設施安全局（CISA）於週二呼籲各機構立即更新其 Ivanti Connect Secure（ICS）設備及部署版本。此前，一個已被實際利用的認證繞過漏洞 CVE-2026-104935 獲披露，其 CVSS 評分達 8.6 分。
該漏洞容許攻擊者繞過受影響 ICS 部署的認證機制，且已在野外遭實際利用。Honeypot 遙測數據已記錄針對該漏洞的 105 次 exploit 嘗試 —— 防守方應將此數字視作下限而非上限。Honeypot 通常只能捕捉投機性、低技術含量的掃描活動；較為針對性的入侵行動（intrusion sets）很可能早已接觸相關漏洞設備，只是未被同一批感應器記錄在內。
名詞說明：此處的「ICS」是指 Ivanti Connect Secure，即廣泛部署的遠端存取 VPN 產品 —— 並非工業控制系統（industrial control systems）。
為何此漏洞須優先處理
VPN 設備的認證繞過漏洞，在防守方的風險層級中位居前列。這類設備按設計本身面向互聯網，且屬高信任級別：入侵者一旦透過繞過登入機制取得立足點，其活動從網絡內部看來形同正常，得以在不即時觸發警報的情況下展開 lateral movement。正是這種外部暴露面與高權限功能的組合，促使 CISA 加入加速補救（expedited remediation）要求，而非僅發出一般性通告。
此決定亦有其歷史背景。此前，Ivanti 設備漏洞曾被用作初始入侵途徑（initial-access vector），相關攻擊行動被歸因於疑似中國國家級行為者，包括多宗針對美國聯邦網絡的高調入侵事件。各機構應假設類似的攻擊腳本（playbook）已在運作之中：先作大範圍偵察、優先鎖定未修補設備，然後悄然建立持久化機制。
現在應採取的措施
此處的營運風險並不在於修復工作的難度，而在於補丁週期與遭到入侵之間的時間差 —— 對投機性攻擊而言，這段差距往往只以小時計算。以下為實務應變清單：
- 先作盤點。 識別機群中每一部面向互聯網的 ICS 設備，包括分辦事處及較舊型號等通常不會出現在變更管理紀錄中的設備。
- 立即更新。 按照 Ivanti 的補丁說明，將受影響的部署升級至最新版本。
- 執行原廠工具。 在所有設備上執行 Ivanti 的完整性檢查及外部暴露面檢查工具。
- 輪換憑證。 將所有設備本地及下游的認證材料視為可能已遭洩露。
- 搜尋持久化機制。 檢查是否存在 webshell、來歷不明的管理員帳戶、未經授權的配置改動，以及無法解釋的對外連線。
- 如懷疑已遭入侵，則重建系統。 進行恢復原廠設定（factory reset）並從已知良好的備份還原，而非嘗試精準移除入侵者。
完整的補救指引可參閱 CISA 的通告。
對所有使用遠端存取 VPN 硬件的機構 —— 不單是 Ivanti 客戶 —— 更廣泛的教訓是做好資產盤點管理。風險最高的機群，往往正是眾人早已忘記自己擁有的那些設備。本報道將在 Ivanti 或 CISA 公布更多技術細節後更新。