Attackers chain three Ivanti Connect Secure flaws for unauthenticated root
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV; UTA0576 paired them with CVE-2026-104935, and fixes are in 25.1.1.3 and 22.8R2.6.
84
Vendor
Ivanti
- Mentions · 7d10
- Mentions · 30d48
- All mentions69
- First seenAug 12, 2026
- Last mentioned6h ago
Timeline
69 articles · newest firstCISA adds two exploited Ivanti Connect Secure flaws to KEV
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
76
Ivanti Connect Secure zero-days exploited for root access and credential theft
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
86
Ivanti Connect Secure zero-days chained for unauthenticated root
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
88
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
74
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357
A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.
74
CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV
CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.
82
LevelBlue: vulnerability exploitation rose to 14% of initial access
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
36
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
Check Point weekly brief: utility and app breaches, exploited zero-days
CenterPoint says more than 1 million Texans were exposed, while Burger King Japan cites about 11.18 million members.
64
Ledger implant linked to $93M theft; npm flaw hit 1,500 packages
The roundup also covers an exploited Windows Shell flaw and an Ivanti Connect Secure zero-day chain.
74
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
88
Prolific Chinese espionage group exploits BeyondTrust zero-day
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting in late August.
84
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
86
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.
84
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
China-nexus UNC5221 exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and wiped logs.
86
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.
87
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability
Actively exploited Ivanti Connect Secure flaw CVE-2026-104935 lets unauthenticated attackers bypass authentication and run commands.
88
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials
CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.
92
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Attackers exploited Ivanti Connect Secure zero-day CVE-2026-104935 for unauthenticated remote code execution.
84
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
82
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Ivanti patched Connect Secure zero-day CVE-2026-104935 after UTA0576 used it for remote command execution.
84
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.
88
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.
87
Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
86
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Volexity found UTA0576 chaining three Ivanti Connect Secure zero-days for unauthenticated root and credential theft.
88
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks
Ivanti patched CVE-2026-104935 after UTA0576 chained flaws to root on Connect Secure VPN appliances.
88
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
Ivanti Connect Secure zero-day CVE-2026-104935 was exploited before patching, and CISA added it to KEV.
85
Ivanti security advisory (AV26-1035)
Canada flags Ivanti flaws after CISA added Connect Secure CVE-2026-104935 to the KEV catalog.
80
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
CISA added exploited Ivanti Connect Secure CVE-2026-104935 to KEV, with a federal deadline of October 16.
82
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
86
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited for unauthenticated remote command execution.
86
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
Attackers are exploiting an Ivanti Connect Secure zero-day for unauthenticated commands, credential theft, and data exfiltration.
86
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Microsoft Windows and Ivanti Connect Secure flaws to the KEV catalog.
78
CISA adds Ivanti Connect Secure auth bypass to KEV (CVE-2026-104935)
Unauthenticated attackers can run commands on ICS before 25.1.3.0; the federal due date is October 16.
82
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
Related CVEs
by mentions- CVE-2026-10493587%8.6Auth Bypass to Command Execution in Ivanti Connect Secure
- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2026-111357<1%7.0Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
- Predictable identifiers in Ivanti Connect Secure enable file upload
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-835271%8.1Authentication Bypass in Ivanti Sentry Grants Remote Admin Access
Appears with
- Ivanti Connect Secureproduct · 30
- CISAorganization · 29
- Volexityorganization · 17
- Microsoftvendor · 16
- Citrixvendor · 12
- UTA0576threat actor · 12
- BeyondTrustvendor · 11
- Ivanti Sentryproduct · 10
- Fortinetvendor · 8
- Armory Castlethreat actor · 8
- UNC5221threat actor · 7
- Black Lotus Labsorganization · 7
- Mandiantorganization · 7
- Palo Alto Networksvendor · 6
- LiteLLMproduct · 6
- ManageEnginevendor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.