Ivanti warns of Connect Secure zero-day exploited in attacks

CVE v události 1

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 8.6.

Tahle CVE jsem vytáhl z širšího textu článku: CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2025-0282, CVE-2025-22457. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.

Jak se o tom psalo 7

1. 14. 10. 2026 · zachyceno 04:30 · NCSC-FI FI

   Ivanti Connect Secure -tuotteissa haavoittuvuutta käytetty hyväksi

   Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 8.6, CVEs: CVE-2026-104935, Summary: Haavoittuvuus koskee Ivanti Connect Secure -tuotteeseen versioita 22.8R2.4 ja sitä vanhempia 22.8-haaran versioita sekä versioita 25.1.1.1 ja 25.1.2.2 ja vanhempia versioita kyseisissä ohjelmistohaaroissa. Ivantin mukaan versio 22.7R2.14 ja sitä vanhemmat 22.7-haaran versiot eivät ole haavoittuvia. Ivantin mukaan haavoittuvuus ei koske versiota 22.7R2.14 eikä sitä…

2. 13. 10. 2026 19:06 · Rapid7 US

   Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

   Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands. Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero…

3. 13. 10. 2026 17:45 · BleepingComputer US nadpis události

   Ivanti warns of Connect Secure zero-day exploited in attacks

   Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]

4. 13. 10. 2026 17:32 · Volexity US

   A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

   Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred. In the first week of October 2026, Volexity discovered an unknown threat…

5. 13. 10. 2026 17:00 · NCSC-NL NL

   NCSC-2026-0416 [1.00] [H/H] ZeroDay kwetsbaarheid verholpen in Ivanti Connect Secure

   Ivanti heeft een kwetsbaarheid verholpen in Connect Secure. Een kwaadwillende kan de kwetsbaarheid misbruiken om zonder voorafgaande authenticatie willekeurige commando's uit te voeren op het kwetsbare systeem. Ivanti meldt op de hoogte te zijn van rapporten dat de kwetsbaarheid als ZeroDay kwetsbaarheid is misbruikt. Er is (nog) geen publieke Proof-of-Concept (PoC) beschikbaar, maar het NCSC verwacht dat publieke PoC of exploitcode op korte termijn beschikbaar komt, wat de kans op grootschalig…

6. 13. 10. 2026 · zachyceno 14. 10. 2026 00:30 · CISA Advisories US

   CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

   CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber threat actors exploiting this zero-day authentication bypass vulnerability, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog on…

7. 13. 10. 2026 · zachyceno 17:00 · CISA KEV US

   Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935)

   CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog. Affected product: Ivanti Connect Secure. Remediation due date: 2026-10-16.