Update June 15, 00:54 EDT: An Ivanti spokesperson told BleepingComputer that CISA added the flaw to its KEV catalog based on reports of attempted exploitation of honeypots. "While this CVE carries a CVSS score of 10, the risk posed to customers is decreased significantly based on deployment and configuration," the spokesperson added. "Successful exploitation requires access to the management port 8443 and this port should never be exposed to the internet. Honeypots often have misconfigurations to identify and track malicious behavior." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch an actively exploited Ivanti Sentry flaw within three days, as mandated by the newly issued Binding Operational Directive (BOD) 26-04. Tracked as…