Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
AI agents, botnets and security updates rounded up for the week.
15
Product
Ivanti Connect Secure
- Mentions · 7d1
- Mentions · 30d30
- All mentions32
- First seenSep 25, 2026
- Last mentioned3d ago
Timeline
32 articles · newest firstCISA adds exploited Ivanti Connect Secure flaws to its KEV catalog
Agencies must fix CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13; UTA0576 chained them with CVE-2026-104935 for root access.
84
Attackers chain three Ivanti Connect Secure flaws for unauthenticated root
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV; UTA0576 paired them with CVE-2026-104935, and fixes are in 25.1.1.3 and 22.8R2.6.
84
CISA adds two exploited Ivanti Connect Secure flaws to KEV
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
76
Ivanti Connect Secure zero-days exploited for root access and credential theft
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
86
Ivanti Connect Secure zero-days chained for unauthenticated root
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
88
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
74
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357
A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.
74
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
84
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability
Actively exploited Ivanti Connect Secure flaw CVE-2026-104935 lets unauthenticated attackers bypass authentication and run commands.
88
CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials
CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.
92
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Attackers exploited Ivanti Connect Secure zero-day CVE-2026-104935 for unauthenticated remote code execution.
84
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
82
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.
88
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
87
Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
86
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Volexity found UTA0576 chaining three Ivanti Connect Secure zero-days for unauthenticated root and credential theft.
88
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks
Ivanti patched CVE-2026-104935 after UTA0576 chained flaws to root on Connect Secure VPN appliances.
88
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
Ivanti Connect Secure zero-day CVE-2026-104935 was exploited before patching, and CISA added it to KEV.
85
Ivanti security advisory (AV26-1035)
Canada flags Ivanti flaws after CISA added Connect Secure CVE-2026-104935 to the KEV catalog.
80
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
CISA added exploited Ivanti Connect Secure CVE-2026-104935 to KEV, with a federal deadline of October 16.
82
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
86
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited for unauthenticated remote command execution.
86
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Microsoft Windows and Ivanti Connect Secure flaws to the KEV catalog.
78
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
Attackers are exploiting an Ivanti Connect Secure zero-day for unauthenticated commands, credential theft, and data exfiltration.
86
CISA adds Ivanti Connect Secure auth bypass to KEV (CVE-2026-104935)
Unauthenticated attackers can run commands on ICS before 25.1.3.0; the federal due date is October 16.
82
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions
Nation-state actors abuse SS7, BGP, and unpatched telecom routers, including Salt Typhoon persistence via GRE tunnels.
60
Related CVEs
by mentions- CVE-2026-10493589%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2026-111357<1%7.0Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
- CVE-2026-118527<1%4.3Predictable identifiers in Ivanti Connect Secure enable file upload
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2026-10276478%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- Exposed endpoint leaks auth data in Ivanti Neurons Patch for Intune
Appears with
- Ivantivendor · 32
- CISAorganization · 22
- Volexityorganization · 17
- UTA0576threat actor · 12
- Citrixvendor · 5
- Mandiantorganization · 4
- Warp Pandathreat actor · 4
- Armory Castlethreat actor · 4
- UNC5221threat actor · 4
- Google Threat Intelligence Grouporganization · 4
- BeyondTrustvendor · 4
- BeyondTrust Remote Supportproduct · 3
- Sawflymalware · 3
- Citrix NetScalerproduct · 3
- Bareclawmalware · 3
- Palo Alto Networksvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.