SecurityOnlineDo Son
Ivanti Connect Secure flaws exploited in zero day attacks
Part of the CVE-2026-104935 story · since 13 Oct
Developinglatest 46 minutes ago16 articles7 outlets
- Tue 13 Oct, 15:32 UTC. CISA, first report. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
- Tue 13 Oct, 16:27 UTC. SecurityOnline, its first report on the story. Ivanti Connect Secure flaw bypasses authentication in active attacks. Cites a CVE in CISA KEV.
- Tue 13 Oct, 18:48 UTC. Security Affairs, its first report on the story. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution. Cites a CVE in CISA KEV.
- Tue 13 Oct, 18:49 UTC. SecurityWeek, its first report on the story. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials. Cites a CVE in CISA KEV.
- Tue 13 Oct, 19:25 UTC. The Hacker News, its first report on the story. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In. Cites a CVE in CISA KEV.
- Tue 13 Oct, 19:25 UTC. SecurityOnline. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs. Cites a CVE in CISA KEV.
- Tue 13 Oct, 21:14 UTC. Rapid7, its first report on the story. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive. Cites a CVE in CISA KEV.
- Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day. Cites a CVE in CISA KEV.
- Wed 14 Oct, 08:01 UTC. SecurityOnline. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery. Cites a CVE in CISA KEV.
- Wed 14 Oct, 10:27 UTC. Security Affairs. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026. Cites a CVE in CISA KEV.
- Wed 14 Oct, 12:50 UTC. The Hacker News. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks. Cites a CVE in CISA KEV.
- Wed 14 Oct, 21:41 UTC. Security Affairs. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections. Cites a CVE in CISA KEV.
- Wed 14 Oct, 22:17 UTC. Dark Reading, its first report on the story. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched. Cites a CVE in CISA KEV.
- Fri 16 Oct, 20:58 UTC. Dark Reading. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
- Fri 30 Oct, 04:30 UTC. SecurityOnline. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV. This article, 16th of 16.
Ivanti Connect Secure is being exploited in the wild through a chained zero-day affecting multiple versions of the vendor’s remote access appliances. The primary flaw, CVE-2026-104935, enables unauthenticated remote command execution via an authentication bypass in the web components. The attack is then chained with two secondary flaws, CVE-2026-118527 (predictable filenames during file processing) and CVE-2026-111357 (an unauthenticated, critical function), to achieve local privilege escalation to root.
Cybersecurity firm Volexity worked with Ivanti to analyse the behaviour of threat actors, and Ivanti confirms exploitation in the wild affecting a limited number of customers at disclosure.
Ivanti has issued patches for all supported releases. The advisory urges immediate upgrades to 25.1.3.1, 25.1.3.0, or 22.8R2.6 (and related 25.1.1.3 where relevant), noting that the chained flaws were exploited in real campaigns. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior for CVE-2026-104935, with CVE-2026-111357 and CVE-2026-118527 impacting 25.1.1[.]2 and prior, and 22.8R2.5 and prior.
Ivanti recommends running the Integrity Checker Tool, reviewing indicators from Volexity’s post, monitoring logs for suspicious inbound connections, and isolating any compromised devices.
How the story developed
Developinglatest 46 minutes ago16 articles7 outlets
16 articles from 7 outlets since 13 Oct. Picked up again today after 13 days quiet. This was the 16th report, 17 days after the first.
- Tue 13 Oct, 15:32 UTC. CISA, first report. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
- Tue 13 Oct, 16:27 UTC. SecurityOnline, its first report on the story. Ivanti Connect Secure flaw bypasses authentication in active attacks. Cites a CVE in CISA KEV.
- Tue 13 Oct, 18:48 UTC. Security Affairs, its first report on the story. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution. Cites a CVE in CISA KEV.
- Tue 13 Oct, 18:49 UTC. SecurityWeek, its first report on the story. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials. Cites a CVE in CISA KEV.
- Tue 13 Oct, 19:25 UTC. The Hacker News, its first report on the story. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In. Cites a CVE in CISA KEV.
- Tue 13 Oct, 19:25 UTC. SecurityOnline. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs. Cites a CVE in CISA KEV.
- Tue 13 Oct, 21:14 UTC. Rapid7, its first report on the story. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive. Cites a CVE in CISA KEV.
- Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day. Cites a CVE in CISA KEV.
- Wed 14 Oct, 08:01 UTC. SecurityOnline. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery. Cites a CVE in CISA KEV.
- Wed 14 Oct, 10:27 UTC. Security Affairs. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026. Cites a CVE in CISA KEV.
- Wed 14 Oct, 12:50 UTC. The Hacker News. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks. Cites a CVE in CISA KEV.
- Wed 14 Oct, 21:41 UTC. Security Affairs. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections. Cites a CVE in CISA KEV.
- Wed 14 Oct, 22:17 UTC. Dark Reading, its first report on the story. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched. Cites a CVE in CISA KEV.
- Fri 16 Oct, 20:58 UTC. Dark Reading. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
- Fri 30 Oct, 04:30 UTC. SecurityOnline. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV. This article, 16th of 16.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 16 articles as a listHide the list
- Tue 13 OctDay 07
- CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution15:32 · CISA · official · First report · CISA alert · Known exploited CVE
- Ivanti Connect Secure flaw bypasses authentication in active attacks16:27 · SecurityOnline · Known exploited CVE
- CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution18:48 · Security Affairs · Known exploited CVE
Show 4 more from 13 Oct
- Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials18:49 · SecurityWeek · Known exploited CVE
- Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In19:25 · The Hacker News · Known exploited CVE
- Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs19:25 · SecurityOnline · Known exploited CVE
- Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive21:14 · Rapid7 · Known exploited CVE
- Wed 14 OctDay 17
- Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day08:01 · SecurityWeek · Known exploited CVE
- Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery08:01 · SecurityOnline · Known exploited CVE
- Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access10:27 · Security Affairs · Known exploited CVE
Show 4 more from 14 Oct
- Microsoft Ends Windows 11 24H2 Support for Consumers in October 202611:01 · SecurityOnline · Known exploited CVE
- CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks12:50 · The Hacker News · Known exploited CVE
- CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections21:41 · Security Affairs · Known exploited CVE
- Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched22:17 · Dark Reading · Known exploited CVE
Quiet for 2 days
Fri 16 OctDay 31- China-linked hackers exploited BeyondTrust zero-day to steal credentials20:58 · Dark Reading · Known exploited CVE
Quiet for 13 days
Fri 30 OctDay 171- Ivanti Connect Secure flaws exploited in zero day attacks04:30 · SecurityOnline · Picked up again · Known exploited CVE · This article, 16th of 16