October 31, 2026
- Two more Ivanti Connect Secure bugs hit KEV, used as a chain with the October 13 zero-day CVE-2026-104935: CVE-2026-111357 (missing authentication on a critical function, local authenticated privesc) and CVE-2026-118527 (predictable identifiers allowing an authenticated attacker to drop files at a known on-disk location) (CISA).
· Vulnerabilities & Exploits
in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
October 25, 2026
- Ivanti Connect Secure CVE-2026-104935, an authentication bypass by spoofing, is listed in CISA KEV as exploited in the wild, non-ransomware, with a mitigation deadline that passed on October 16. (DarkFeed)
· Vulnerabilities & Exploits
in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox
October 16, 2026
- The Ivanti zero-day chain now has public mechanics and a reported independent reproduction. Horizon3.ai says CVE-2026-104935 stems from Ivanti Connect Secure checking one URL for authentication but letting an attacker-controlled header select the CGI script that executes. Attackers chain that mismatch with a temporary file-write path to run code as
cgi-server; observed intrusions added a separate privilege-escalation flaw for root. CISA warns that Ivanti’s Integrity Checker may miss memory-only command execution, and Doonsec reports reproducing the unauthenticated RCE and privilege-escalation chain. This adds exploit detail to the initial disclosure (earlier coverage).
· Vulnerabilities & Exploits
in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware
October 14, 2026
- Ivanti Connect Secure is under active in-the-wild exploitation via CVE-2026-104935, an authentication bypass plus race-condition RCE chained with a separate privilege-escalation bug to reach root. Volexity says UTA0576 hit a fully patched 22.8R2.4 appliance on 3 October 2026; notably the actor deployed no web shell or backdoor, going straight for credential theft and data exfiltration (Volexity, Ivanti advisory). Ivanti has patched two of the three; a fix for the third is still pending per Volexity (The Hacker News). CISA added it to KEV the same day (CISA); NCSC-NL notes no public PoC yet but expects one shortly (NCSC-NL). @watchtowrcyber says it is actively notifying platform clients of exposure. (discussion)
· Vulnerabilities & Exploits
in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN
July 4, 2026
- Ivanti Sentry and EPMM unauth RCE. CERT-EU reiterated critical flaws enabling unauthenticated remote code execution across Ivanti Sentry and EPMM products, one of which has seen limited exploitation. CERT-EU 2026-008
· Vulnerabilities & Exploits
in Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat