Ivanti Connect Secure zero-days exploited for root access and credential theft
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
86
Organization
Volexity
- Mentions · 7d2
- Mentions · 30d16
- All mentions25
- First seenAug 17, 2026
- Last mentioned13h ago
Timeline
25 articles · newest firstIvanti Connect Secure zero-days chained for unauthenticated root
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
88
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability
Actively exploited Ivanti Connect Secure flaw CVE-2026-104935 lets unauthenticated attackers bypass authentication and run commands.
88
CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials
CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.
92
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Attackers exploited Ivanti Connect Secure zero-day CVE-2026-104935 for unauthenticated remote code execution.
84
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti patched Connect Secure zero-day CVE-2026-104935 after UTA0576 used it for remote command execution.
84
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.
88
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
87
Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
86
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Volexity found UTA0576 chaining three Ivanti Connect Secure zero-days for unauthenticated root and credential theft.
88
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks
Ivanti patched CVE-2026-104935 after UTA0576 chained flaws to root on Connect Secure VPN appliances.
88
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
Ivanti Connect Secure zero-day CVE-2026-104935 was exploited before patching, and CISA added it to KEV.
85
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
86
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited for unauthenticated remote command execution.
86
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
Attackers are exploiting an Ivanti Connect Secure zero-day for unauthenticated commands, credential theft, and data exfiltration.
86
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
Chinese actor UTA0565 chains three Chrome and Windows zero-days via fake NGO media sites to drop CLEANGULP backdoor malware on Asian government targets.
92
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
Volexity says China-linked UTA0565 exploited Chrome and Windows zero-days against Asian governments.
88
Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
Volexity links third Chinese actor UTA0565 to typosquatted phishing sites chaining Chrome and Windows zero-days to deploy CLEANGULP backdoor.
85
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
Microsoft patched a CVSS 10.0 missing-authentication privilege escalation flaw, CVE-2026-85889, in Azure AI Foundry, already fully mitigated server-side.
65
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
85
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
90
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
72
Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022
Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.
80
Related CVEs
by mentions- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2026-111357<1%7.0Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
- Predictable identifiers in Ivanti Connect Secure enable file upload
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
Appears with
- Ivantivendor · 16
- Ivanti Connect Secureproduct · 15
- UTA0576threat actor · 11
- CISAorganization · 10
- Microsoftvendor · 4
- Googlevendor · 4
- APT31threat actor · 4
- Proofpointorganization · 4
- Volexityvendor · 3
- UTA0560threat actor · 2
- Chromeproduct · 2
- UNK_LateNightthreat actor · 2
- UTA0565organization · 2
- Microsoft Windowsorganization · 2
- Google Threat Intelligence Grouporganization · 2
- Grimwedgemalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.