CVE-2026-104935
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
Vulnerabilities & Exploits · Zero-Day Exploit
Volexity said UTA0576 is actively exploiting CVE-2026-104935 in Ivanti Connect Secure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Ivanti also shipped fixes for the authentication-bypass and remote code execution parts of the chain, while a separate privilege-escalation bug is still pending.
The chain lets an attacker make the appliance treat a request as already authenticated, then turn that into arbitrary command execution and root. Volexity said the compromise sat largely in memory and the attacker wiped Ivanti debug and Linux audit logs, so a patched gateway can still hide a past intrusion from routine checks.
For teams that use Connect Secure as the trust gate to internal networks and Active Directory, the open question is not just whether the box is patched but whether it was already used to harvest credentials or other secrets. If that happened, the exposure can extend beyond the appliance into downstream identity systems even after the VPN itself is updated.
18 sources · Oct 14
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
Cisco PSIRT
Cisco Security Advisory: Cisco Secure Email Gateway Arbitrary File Write Vulnerability
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp For further documentation of improvements and fixes in Cisco Secure Email Gateway, see Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026.
originalNCSC-NL Advisories
Kwetsbaarheden verholpen in Fortinet FortiSandbox
De kwetsbaarheid met kenmerk CVE-2026-107656 heeft een CVSS-score van 9,6 en betreft een authenticatieomzeiling in de webmanagementinterface van FortiSandbox.
originalCisco PSIRT CSAF
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway Arbitrary File Write Vulnerability.
originalPart of the PlainSec briefing for 2026-10-13
Every edition of this story: Ivanti Connect Secure exploit added to KEV