Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #8
Ivanti Connect Secure zero-day actively exploited in the wild
Original: 🚨 Ivanti Connect Secure zero-day — CVE-2026-104935 (CVSS 8.6), actively exploited, CISA KEV Auth bypass by spoofing → un
A new zero-day in Ivanti Connect Secure, tracked as CVE-2026-104935 with a CVSS score of 8.6, is being actively exploited. The flaw allows authentication bypass via spoofing, leading to unauthenticated remote code execution on the VPN appliance. The threat has been added to CISA's Known Exploited Vulnerabilities catalog. Security firm Volexity documented threat actor UTA0576 chaining three vulnerabilities to gain root access on a fully patched appliance, using a memory-only attack that leaves no backdoor on disk.
Why now: Security teams are urgently assessing exposure after a zero-day in a widely deployed enterprise VPN was added to CISA's KEV list while being actively exploited.
IvantiCISAVolexityUTA0576Ivanti Connect Secure
Evidence
- 🚨 Ivanti Connect Secure zero-day — CVE-2026-104935 (CVSS 8.6), actively exploited, CISA KEV Auth bypass by spoofing → unauthenticated RCE on the VPN appliance. Volexity documented UTA0576 chaining 3 vulns for root on a fully patched box. Memory-only attack, no backdoor,… · threataft@infosec.exchange · 3
API: https://socialmediatrends-api.osmike.com/v1/trends/2176151