Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Ivanti Connect Secure authentication bypass (CVE-2026-104935)

Vulnerability
First reported
Last updated
Happening score
H score 42
1 unique sources, 1 articles

Summary

Hide ▲

Ivanti Connect Secure (ICS) has an actively exploited authentication bypass zero-day tracked as CVE-2026-104935, creating unauthenticated remote code execution risk on impacted appliances. Ivanti told customers to immediately patch affected versions, and later reporting tied the flaw to root-level code execution on fully patched devices when chained with other vulnerabilities.

Related Happenings

Operation Escaneo Latin America intrusion campaign targeting government and finance

Campaign
H score57 First: 18.06.2026 14:30 Last: 18.06.2026 14:30 Sources 1

About this happening: The Operation Escaneo campaign exposed a coordinated intrusion effort against government and financial targets across Latin America, with confirmed victim access and d...

Open Happening

CISA emergency patch deadline for Ivanti EPMM

Public Sector Action
H score40 First: 08.05.2026 15:16 Last: 08.05.2026 15:16 Sources 1

About this happening: CISA ordered U.S. federal agencies to patch Ivanti EPMM by midnight Sunday, May 10 after adding CVE-2026-6973 to its list of vulnerabilities exploited in attacks....

Open Happening

CISA KEV listing and FCEB patch order for Ivanti EPMM

Public Sector Action
H score40 First: 08.04.2026 21:15 Last: 08.04.2026 21:15 Sources 1

About this happening: CISA added CVE-2026-1340 to the KEV Catalog and ordered FCEB agencies to patch Ivanti Endpoint Manager Mobile (EPMM) by Saturday midnight, April 11, forcin...

Open Happening

Storm-1175 high-velocity zero-day and N-day intrusion campaign

Campaign
H score44 First: 07.04.2026 09:35 Last: 07.04.2026 09:35 Sources 1

About this happening: Storm-1175 is running a high-velocity intrusion campaign that chains zero-day and N-day vulnerabilities to gain initial access to exposed systems, raising the risk...

Open Happening

RESURGE malware analysis update adds stealth, TLS, and C2 findings on Ivanti Connect Secure

Technical Analysis
H score27 First: 26.02.2026 14:00 Last: 26.02.2026 14:00 Sources 1

About this happening: New technical findings on RESURGE sharpen detection of a stealthy implant that can hide on Ivanti Connect Secure devices and enable covert SSH-based command-and-control*...

Open Happening

Timeline

  1. 13.10.2026 18:45 1 articles · 2h ago

    Defused sees early CVE-2026-104935 exploitation against Ivanti Connect Secure

    Detection Ioc Update

    Defused says it caught the first signs of CVE-2026-104935 exploitation in the wild starting October 1 against Ivanti Connect Secure appliances.

    Show sources
    Open in new tab
  2. 13.10.2026 18:45 1 articles · 2h ago

    UTA0576 chains CVE-2026-104935 into root-level code execution

    Exploitation Observed

    Volexity says the threat actor it tracks as UTA0576 has chained CVE-2026-104935 with two other flaws since at least October 3 to achieve unauthenticated root-level code execution on fully patched Ivanti Connect Secure devices, while re-exploiting the device for each command and tampering with logs.

    Show sources
    Open in new tab
  3. 13.10.2026 18:45 2 articles · 2h ago

    Ivanti discloses CVE-2026-104935 and urges immediate patching

    Initial Disclosure

    Ivanti disclosed CVE-2026-104935 as an actively exploited authentication bypass in Ivanti Connect Secure, said it was aware of limited exploitation in the wild, and urged customers running 22.8R2.4 and earlier, 25.1.2.2 and earlier, or 25.1.1.1 and earlier to upgrade to the fixed version, review the security advisory, and run the Integrity Checker Tool regularly.

    Show sources
    Open in new tab