Ivanti Secure Connect has an in the wild zero day allowed unauth RCE, patch is out

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

CVE-2026-104935

related to the above

An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity.

https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900

#ThreatIntel #ThreatIntelligence #IFIN

New Ivanti zero-day

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

Ivanti Connect Secure zero-day CVE-2026-104935 (8.6 high)
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

#ivanti #ics #zeroday #eitw #cve

Security Advisory Ivanti Connect Secure (CVE-2026-104935)

#ivanti #cybersecurity #cve #vulnerabilitymanagement #vuln

🔗 https://vulnerability.circl.lu/vuln/CVE-2026-104935#sightings

🔗 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

@volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.

Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure. 

Read the full analysis, including detection guidance and IOCs, in our blog post here: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

#DFIR #threatintel #memoryforensics

Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now.

#Ivanti #ConnectSecure #CVE2026104935 #ExploitedInTheWild #VPNSecurity #ZeroDay #PatchNow #CyberSecurity

https://securityonline.info/ivanti-connect-secure-cve-2026-104935-exploited/?utm_source=mastodon&utm_medium=jetpack_social

UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.

#Ivanti #ZeroDay #CVE2026104935 #UTA0576 #Volexity #VPN #ActiveDirectory #Cybersecurity

https://securityonline.info/ivanti-connect-secure-zero-day-cve-2026-104935/?utm_source=mastodon&utm_medium=jetpack_social

Ivanti warns of Connect Secure zero-day exploited in attacks

Ivanti has urged customers to immediately patch an actively exploited zero-day in the Ivanti Connect Secure remote access gateway, BleepingComputer reports. CVE-2026-104935 is a high-severity authentication bypass affecting ICS versions 22.8R2.4 and earlier that lets unauthenticated attackers execute arbitrary commands on targeted appliances. https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/

🚨 NEW on CISA KEV — exploited in the wild

🛡 Ivanti Connect Secure
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
CVE: CVE-2026-104935 · patch by 2026-10-16

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-104935
#cybersecurity #KEV #CVE #infosec

Placeholder CISA blog post about Ivanti Connect Secure zero-day CVE-2026-104935 and Microsoft Windows Shell Security Feature Bypass zero-day CVE-2026-96951

https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog

#CISA #KEV #eitw #zeroday #PatchTuesday

On October 12, GitLab patched CVE-2026-97229, a CVSS 10 flaw. Under certain conditions, an unauthenticated attacker can use a crafted CI/CD regex to execute code on a self-managed server.

Upgrade affected installations to 19.2.8, 19.3.5 or 19.4.2 now. GitLab.com is already patched; Dedicated customers need no action.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

#Cybersecurity #GitLab #DevSecOps

Don't use Docker.

https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

Docker Hub flaw let attackers impersonate users, tamper with images

Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers impersonate other users and tamper with their container images, BleepingComputer reports. The flaw involved personal access tokens being reassigned to a designated organization owner without changing the token’s secret or obtaining the target’s consent. https://www.bleepingcomputer.com/news/security/docker-hub-flaw-let-attackers-impersonate-users-tamper-with-images/

Read the latest Docker Hub security advisory regarding CVE-2026-105445. Learn how this critical access token vulnerability impacts supply chain security.

#DockerHub #SecurityAdvisory #CVE2026105445 #CyberSecurity #SupplyChain

https://securityonline.info/docker-hub-security-advisory-cve-2026-105445/?utm_source=mastodon&utm_medium=jetpack_social

Supermarket Fridges Hacked, Plus 3 Tech Stories https://raymondtec.com/2026/10/supermarket-refrigeration-cyberattack-plus-3-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

A supermarket refrigeration cyberattack spoiled food and caused fires in France. Plus an exploited Bricksforge flaw, workplace data sales, and bank AI scrutiny.

#TechNews #AIAgents #Bricksforge #CVE202685097 #Danfoss #IndustrialControlSystems #privacy

Bricksforge (plugin WordPress) CVE-2026-85097, CVSS 10.0 secondo Patchstack: upload di file non autenticato → RCE. Sfruttata dal 7/10, 63 IP sorgente, polyglot GIF/PHP con estensioni offuscate.

Fix: 3.1.8.10 o successiva. Detection: richieste a /wp-json/bricksforge/v1/form_submit con temporaryFileUploads; PHP inattesi in /wp-content/uploads/bricksforge/tmp/ (es. login_admin_*.php). La patch non rimuove una compromissione già avvenuta.

#cybersecurity #WordPress https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/

CVE-2026-85097 Bricksforge Vulnerability: What Site Owners Must Know https://www.esecurityplanet.com/cybersecurity-threats/news-bricksforge-cve-2026-85097-wordpress-rce/

🚨 Rapid Response: Critical AnyDesk Linux Vulnerability (CVE-2026-109390)

A critical pre-authentication vulnerability in AnyDesk for Linux could allow an unauthenticated attacker to execute code as root without user interaction. A working proof-of-concept exploit is now publicly available.

Censys currently detects 175,838 Internet-exposed AnyDesk hosts on TCP port 7070. This figure represents total AnyDesk exposure on the default direct-connection port, not just vulnerable hosts.

Full Censys ARC advisory, including affected versions, exposure data, and remediation guidance: https://censys.com/advisory/cve-2026-109390/

#CensysARC #AnyDesk #Cybersecurity #VulnerabilityManagement

Last week, GreyNoise reported Hikvision CVE-2021-36260 exploitation attempts against Ukraine that ran for nine days, then stopped.

Near zero for months. A surge from Sep 23 to Oct 1, almost all from four IPs. Then nothing from those four since.

🔗 Full analysis: https://www.greynoise.io/blog/hikvision-camera-exploitation-attempts-ukraine

Discover how recent Hikvision camera attacks in Ukraine exploit the CVE-2021-36260 vulnerability for potential remote surveillance. Learn how to secure IoT.

#Hikvision #CyberSecurity #Ukraine #Vulnerability #IoT

https://meterpreter.org/hikvision-camera-attacks-ukraine/?utm_source=mastodon&utm_medium=jetpack_social

Hey blue teams, get active.

https://nvd.nist.gov/vuln/detail/cve-2026-87689

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

CVE-2026-87689 | CRITICAL in Metasploit Framework <=6.5.4: Missing auth on REST API lets unauthenticated users fully access and modify credentials. Upgrade to 6.5.5 or restrict msf-ws access. https://radar.offseq.com/threat/cve-2026-87689-cwe-306-missing-authentication-for-critical-function-in-rapid7-metasploit-framework-3c7c8850454d4a0f #OffSeq #Metasploit #CVE202687689 #infosec

CVE-2026-109110: CRITICAL OS command injection in Wavlink WL-WN592AX6 (v250422). Remote attackers can execute OS commands — exploit published. No patch. Restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-109110-os-command-injection-in-wavlink-wl-wn592ax6-254609e635513843 #OffSeq #CVE2026109110 #IoTSecurity #Vuln