Securityaffairs.Co Ivanti Connect Secure Zero-Day Exploited: Urgent Patching Required
Article Content
- •CVE-2026-104935 allows unauthenticated command execution on Ivanti Connect Secure.
- •Exploitation confirmed in the wild, with the earliest activity noted on October 1, 2026.
- •CISA has added the vulnerability to its KEV catalog, requiring urgent patching.
Ivanti has disclosed a high-severity vulnerability, CVE-2026-104935, affecting its Connect Secure VPN, which allows unauthenticated remote attackers to execute arbitrary commands. The flaw has been actively exploited in the wild, with the earliest confirmed exploitation occurring on October 1, 2026. This vulnerability is part of a chain of three zero-days, with two flaws patched and one pending fix. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging immediate action from organizations. Ivanti recommends that affected customers update their systems to the latest versions and conduct forensic investigations to check for signs of compromise. The threat actor, tracked as UTA0576, has been observed executing commands and stealing credentials without leaving a backdoor. Reliable indicators of compromise are currently unavailable, complicating detection efforts.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (26)
Following this threat?
Track CISA and CVE-2023-46805 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Ivanti Connect Secure are affected?
What should organizations do immediately?
Is there evidence of exploitation?
Continue Reading
ClingSTUN Linux Backdoor Exploits 24 IoT Vulnerabilities Researchers from FortiGuard Labs have identified a new Linux backdoor named ClingSTUN that exploits 24 known vulnerabilities in Internet of Things (IoT) devices. This malware turns infected devices into proxy nodes, using legitimate public STUN servers to obscure communications. The vulnerabilities targeted include… 
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…