CVE-2026-104935
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
Vulnerabilities & Exploits · Zero-Day Exploit
Volexity said UTA0576 is actively exploiting CVE-2026-104935 in Ivanti Connect Secure, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13. Ivanti also shipped fixes for the authentication-bypass and remote code execution parts of the chain, while a separate privilege-escalation bug is still pending.
The chain lets an attacker make the appliance treat a request as already authenticated, then turn that into arbitrary command execution and root. Volexity said the compromise sat largely in memory and the attacker wiped Ivanti debug and Linux audit logs, so a patched gateway can still hide a past intrusion from routine checks.
For teams that use Connect Secure as the trust gate to internal networks and Active Directory, the open question is not just whether the box is patched but whether it was already used to harvest credentials or other secrets. If that happened, the exposure can extend beyond the appliance into downstream identity systems even after the VPN itself is updated.
17 sources · 2h ago
Known exploited · CISA KEV
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16
Cisco PSIRT CSAF
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway Arbitrary File Write Vulnerability.
originalCSO Online
Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
The critical authentication bypass allowed remote attackers to bypass login checks and execute commands on vulnerable appliances before patches were fully backported.
originalHelp Net Security
Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances - Help Net Security
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti's ICS appliances to breach organizations.
originalPart of the PlainSec briefing for 2026-10-14
Every edition of this story: Ivanti Connect Secure exploit added to KEV