Ivanti says CVE-2026-104935 in Connect Secure is exploited. Volexity tracks the actor as UTA0576, active since Oct 3. CISA added it to KEV on Oct 13 (US time). Fixed in 22.8R2.5, 25.1.1.2 and 25.1.3.1, but the privilege escalation step in the chain was still unpatched per Volexity and BleepingComputer. CERT-FR ALE-013: isolate, preserve evidence, run the Integrity Check Tool, treat every secret on the box as stolen.
What to do: Missed by the board on Oct 13. Defused says its decoys saw activity on Oct 1; Volexity says Oct 3. Trust Volexity for the start date. Oct 31: Ivanti Connect Secure: UTA0576 chains three flaws for unauthenticated root; two added to KEV. A new actor, UTA0576, chained CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 to run commands as root on Ivanti Connect Secure VPNs that had earlier patches.…
🚨 We added Ivanti Connect Secure vulnerability CVE-2026-104935 to the KEV Catalog after observed exploitation. A remote attacker could bypass authentication to execute commands, steal credentials, and exfiltrate data. Update now and review our Alert. 🔗
🚨 Our Ivanti Connect Secure decoys caught pre-disclosure exploitation we assess as CVE-2026-104935. Activity was recorded on Oct 1st, twelve days before Ivanti’s advisory, on both our public honeypots and customer instances. The exploit ran an unauthenticated bypass to plant an
🛡️We added Ivanti Connect Secure vulnerabilities CVE-2026-111357 & CVE-2026-118527 to our KEV Catalog. Visit & apply mitigations to protect your org. #Cybersecurity #InfoSec
🚨 Ivanti Connect Secure exploited in the wild. Attackers chained 3 flaws to execute code as root without authentication. CISA has now added 2 of those flaws to its Known Exploited Vulnerabilities catalog. Both are patched. Here's what happened ↓
🚨 Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access A previously unknown threat actor tracked as UTA0576 exploited three vulnerabilities to compromise fully patched Ivanti Connect Secure VPN appliances and execute commands as r
Ivanti patches two more Connect Secure zero-days chained in attacks
Why this score
Plan rubric with caps (verified PM sweep, Oct 24)