What's new: Horizon3’s later Oct. 15 analysis describes inconsistent URL checks that reach protected scripts and a file-write step before a separate privilege escalation to root, narrows affected builds to ICS 25.1.0–25.1.2.2 and 22.8R2 through 22.8R2.4, and advises network and memory forensics because the Integrity Checker can miss in-memory activity.
Merged summary · grok-4.7-build · rewritten as coverage arrives
Attackers exploited Ivanti Connect Secure CVE-2026-104935 before patches; CISA set an October 16 federal fix deadline.
On Oct. 13, 2026, Ivanti disclosed CVE-2026-104935, a CVSS 8.6 authentication bypass in Ivanti Connect Secure that lets a remote unauthenticated attacker run arbitrary commands, and CISA added it to the KEV catalog the same day with an Oct. 16, 2026 deadline for federal civilian agencies. CISA lists affected releases as 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier; fixes are 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, while Rapid7 and CSO say 22.7 and earlier are unaffected and Horizon3 narrows the range to 25.1.0–25.1.2.2 and 22.8R2 through 22.8R2.4. Version 22.8 reaches end of life on Jan. 31, 2027. Ivanti and CISA said exploitation before disclosure affected a limited number of customers. Volexity attributes the activity to UTA0576—called a criminal actor by The Hacker News and an unknown actor by Cyber Security News—which chained the bypass and remote code execution, both tracked as CVE-2026-104935, with a still-unpatched privilege-escalation flaw to reach root on fully patched 22.8R2.4; sources disagree on whether activity began Oct. 1 or Oct. 3 and describe the code-execution step as a race condition or a file write. Attackers stole appliance and directory credentials, including LAPS passwords and BitLocker keys in some accounts, used password spraying or Kerberoasting, and altered logs that the Integrity Checker may miss because activity stayed in memory; CISA says patching alone may be insufficient and recommends a factory reset or rebuild plus secret rotation. Previdian honeypots logged 105 attempts from 50 IPs, Shadowserver tracks more than 5,600 exposed hosts, and separate CVSS 9.9 flaws CVE-2026-106042 and CVE-2026-109412 were not known to be exploited.
CVE-2026-104935 is a CVSS 8.6 authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution; CISA added it to the KEV catalog on Oct. 13, 2026, with a federal civilian deadline of Oct. 16, 2026.
Ivanti shipped fixes the same day in 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1; Rapid7 and CSO say 22.7 and earlier are unaffected, and version 22.8 reaches end of life on Jan. 31, 2027.
Volexity tracks actor UTA0576 chaining CVE-2026-104935 with a still-unpatched privilege-escalation flaw to reach root on fully patched 22.8R2.4; sources place the earliest activity on either Oct. 1 or Oct. 3.
Attackers stole LDAP or VPN and Active Directory secrets, including LAPS passwords and BitLocker keys in some accounts, and used password spraying, Kerberoasting, and log tampering; one report says no malware was deployed.
CISA says Ivanti’s Integrity Checker Tool may miss in-memory activity and that patching alone may be insufficient, recommending a factory reset or rebuild plus rotation of passwords, certificates, API keys, and licenses.
Previdian honeypots logged 105 attempts from 50 IPs in Singapore and the United States; Shadowserver tracks more than 5,600 internet-exposed ICS hosts.
Separate CVSS 9.9 flaws CVE-2026-106042 and CVE-2026-109412 were not known to be exploited.
Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.
Command Injection RCE in Ivanti Connect Secure and Policy Secure
Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure appliances contain a command injection flaw (CWE-77) in their web components, triggered when an authenticated administrator sends crafted requests to the appliance. The bug can be chained with the separate authentication bypass CVE-2023-46805, allowing an unauthenticated attacker to achieve the same result. Successful exploitation lets an attacker execute arbitrary commands and code on the appliance, providing a foothold into the networks behind the VPN or network access control gateway. Any organization running these appliances, typically enterprises and government agencies often deployed directly on the internet perimeter, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-10 with known ransomware use and EPSS assigns a 100% probability of exploitation within 30 days, although no public proof-of-concept is available.
Do: Apply Ivanti's mitigations or patched builds immediately per vendor instructions, addressing the chained authentication bypass CVE-2023-46805 at the same time, and discontinue or restrict use of any appliance for which mitigations are unavailable, especially if it is internet-facing. Because exploitation with ransomware use is known, assume compromise is possible: review appliance web logs for suspicious requests and run Ivanti's integrity-checking guidance to verify appliance images before and after remediation. Where feasible, restrict direct internet exposure of the appliance web interface and monitor for further vendor advisories.
SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component
CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (formerly Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons. A remote attacker can trigger the flaw with crafted unauthenticated requests to the SAML component, causing the appliance to make requests to otherwise restricted resources. Successful exploitation allows the attacker to access certain restricted resources without any credentials, and CISA notes the flaw has been used in ransomware operations. Any organization running an affected Ivanti Connect Secure, Policy Secure, or Neurons deployment is exposed, particularly where the appliance is reachable from the internet. The vulnerability is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-31, carries an EPSS probability of 100%, and no public proof-of-concept is known.
Do: Apply Ivanti's released patches or the vendor-issued mitigations immediately per vendor instructions, or discontinue use of the product if mitigations are unavailable, as required by CISA. Because ransomware use is documented, review SAML-related logs and appliance audit trails for signs of exploitation and follow-on compromise, and check for indicators of post-exploitation activity. Monitor Ivanti advisories for patched version numbers and updated mitigation guidance, since specific fixed versions are not yet specified in the available data.
Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways, reachable by unauthenticated network input. An attacker can trigger it remotely by sending crafted, unauthenticated traffic to a vulnerable gateway, overwriting stack memory and gaining code execution under the appliance's context. Successful exploitation yields unauthenticated remote code execution on the device, giving the attacker control of the VPN/secure-access gateway and a foothold into the protected network. Organizations running any of the affected Ivanti secure-access products are exposed; the source data specifies no version ranges, so defenders should consult Ivanti's advisory for exact affected and fixed releases. The flaw is being actively exploited: it was added to CISA KEV on 2025-01-08 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), despite no public PoC being known.
Do: Apply the patched releases identified in Ivanti's advisory and follow CISA's required action: hunt for signs of compromise, remediate if indicators are found, and apply updates before returning any device to service. Because exploitation is active and ransomware use is known, treat any appliance that was internet-reachable before patching as potentially compromised (check integrity, rotate credentials). Exact fixed versions were not included in the source data, so verify the correct update path for your branch (including older Connect Secure/Policy Secure releases) against Ivanti's bulletin.
Unauthenticated Stack Buffer Overflow RCE in Ivanti Connect Secure
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow (CWE-121) that can be triggered by a remote, unauthenticated attacker sending crafted input that overruns a fixed-size stack buffer on the affected gateway. Successful exploitation yields remote code execution on the appliance, giving an attacker control of an enterprise VPN or zero-trust access gateway and a foothold in the surrounding network. Any organization running the affected Ivanti gateway products is exposed, with impact concentrated among enterprises using these appliances for remote-access VPN and zero-trust network access. The vulnerability was added to CISA's KEV catalog on 2025-04-04 with known ransomware use, and its maximum EPSS score (100.0%, 100th percentile) signals near-certain exploitation pressure within 30 days. No public proof-of-concept is known, but confirmed in-the-wild exploitation makes this an actively abused, high-priority flaw.
Do: Apply the mitigations required by CISA and update Connect Secure, Policy Secure, and ZTA Gateways to the patched releases designated in Ivanti's advisory, prioritizing internet-exposed VPN gateways. Given known ransomware use, review appliance and downstream logs for signs of compromise, and treat unpatched gateways as high risk given the 100th-percentile EPSS score.
Auth Bypass to Command Execution in Ivanti Connect Secure
CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. A remote, unauthenticated attacker can spoof authentication on affected gateways and then execute arbitrary commands. Impact is high confidentiality loss with lower integrity and availability impact (CVSS 3.1 base 8.6; network, low complexity, no privileges or user interaction). It affects Connect Secure builds before 25.1.3.0 and does not affect 22.7R2.14 or earlier. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13 after reported zero-day attacks; ransomware use is listed as unknown, public proof-of-concept references exist, and EPSS is about 26% (98th percentile).
Do: Upgrade Ivanti Connect Secure to 25.1.3.0 or later. Builds at 22.7R2.14 and earlier are not affected. Because this is in CISA’s KEV catalog, apply the vendor’s mitigations, follow BOD 26-04 and CISA forensics-triage guidance, and treat internet-exposed appliances as potentially compromised until reviewed.
8.6
26%
KEV PoC ×2
Ivanti Connect Secure versions before 25.1.3.0, excluding 22.7R2.14 and earlier
Path control in Ivanti Xtraction leaks EPMM credentials
Ivanti Xtraction before version 2026.4 has an external control of file name or path flaw (CWE-73). A remote authenticated attacker can redirect application-generated requests to an attacker-controlled endpoint. Those redirected requests can expose EPMM connector credentials that the application transmits, with critical impact on confidentiality, integrity, and availability beyond the vulnerable component. Organizations running unpatched Xtraction that connect to EPMM are affected. It is not listed in CISA KEV and no public proof-of-concept is known.
Do: Upgrade Ivanti Xtraction to version 2026.4 or later. After patching, rotate EPMM connector credentials that the application may have transmitted, and review authenticated user access and outbound request destinations for unexpected endpoints.
Exposed endpoint leaks auth data in Ivanti Neurons Patch for Intune
CVE-2026-109412 is an exposed dangerous endpoint (CWE-749) in Ivanti Neurons Patch for Intune. A remote attacker who already has low-privilege authentication can reach the endpoint over the network with no user interaction and leak sensitive authentication information. The CVSS 3.1 score is 9.9 (critical) with changed scope and high impact to confidentiality, integrity, and availability, so stolen credentials could be reused against systems beyond the vulnerable component. Organizations that run Ivanti Neurons Patch for Intune are affected; the source data does not name a version range. There is no known public proof-of-concept and the issue is not listed in CISA KEV.
Do: Apply the vendor fix for Ivanti Neurons Patch for Intune as soon as a patched release is identified, and until then restrict network access to the product so only trusted administrators can reach it. Rotate any authentication material that may have been exposed through the endpoint and review access logs for unexpected authenticated calls. Do not wait for a public proof-of-concept; the CVSS score indicates leaked credentials could affect systems beyond the patch component.
Stories merge articles from different outlets about the same event. The summary is rewritten by the model whenever new coverage arrives; individual articles keep their own summaries and full text.
CISA Advisories· 86
Rapid7 Blog· 86