CVE-2026-104935

⚠️ New Actively-Exploited Vulnerability • CVE-2026-104935: Ivanti Connect Secure • Flaw: Authentication bypass by spoofing • Exploited in the wild, not ransomware • Listed in CISA KEV Apply mitigations per vendor instructions by 2026-10-16. Full report: 🔗 https://t.co/3e2zfCtlvp #CyberSecurity #Inf…

🚨 Defending Enterprise Perimeters: Comprehensive Mitigation and Threat Hunting Guide for Ivanti Connect Secure #CVE-2026-104935 + Video -Prediction: 📈 0 Positive | 📉 1 Negative https://t.co/S4xYqX22in Educational Purposes!

Ivanti Connect Secure zero-day (CVE-2026-104935) is being exploited for unauthenticated root command execution, and the attacker leaves little forensic trace — Volexity found an attacker chaining… #CyberSecurity #InfoSec https://t.co/WO6rONkdNe

CVE-2026-104935, published by Ivanti on 13 October 2026. Authentication bypass by spoofing in Ivanti Connect Secure before version 25.1.3.0. CVSS 3.1 base score 8.6.

vanti Connect Secure Zero-Day Chain Gives Attackers Unauthenticated Root Access and Ivanti's Own Integrity Checker Tool Can't Detect It Ivanti is urging customers to immediately patch CVE-2026-104935, an authentication bypass zero-day in Ivanti Connect Secure (ICS) remote access gateways. What make…

Ivanti Connect Secure (CVE-2026-104935) : Attention au-delà du patch. Après l'attaque (logs effacés, secrets AD visés), la rotation des clés et l'analyse post-mortem sont cruciales. ⚠️ #Cybersécurité https://t.co/wUjkFZIB37 https://t.co/XTFT4jvY4b

🔥 IVANTI 0-DAY: CVE-2026-104935 - unauthenticated → ROOT on Connect Secure VPN. Active since Oct 3. CISA KEV deadline TODAY Oct 16. 1. Patch to 22.7R2.5+ 2. Hunt /tmp/.cache/.sess, evil.jsp 3. Block IOCs No workaround for priv-esc yet. #Ivanti #ZeroDay #KEV #infosec https://t.co/mCBKEGJIwI

Ivanti patched CVE-2026-104935 on October 13, 2026 after UTA0576 chained authentication bypass and RCE to gain unauthenticated root on patched ICS 22.8R2.4, with privilege escalation still unpatched. https://t.co/R3WGrwcRQs

‼️ A chain of three Ivanti Connect Secure zero-days let an attacker run commands as root and pull stored credentials off a fully patched appliance. The first of them, CVE-2026-104935, is an authentication bypass by spoofing: the attacker claims an identity the appliance trusts, so the login step ne…

Your VPN had one job. Ivanti Connect Secure's CVE-2026-104935 lets attackers run commands without logging in. Actively exploited. What to do: patch to 25.1.1.2, 25.1.3.1 or 22.8R2.5. Then hunt for compromise, a patch won't evict anyone already in. https://t.co/20YOUg5QnE

GitHub cross-source: Bluefire-Redteam-Cybersecurity/bluefire-ivanti-ics-guard: Bluefire Redteam checker for Ivanti Connect Secure CVE-2026-104935. Version and reachability only.

GitHub cross-source: maxprog-svg/CVE-2026-104935: CVE-2026-104935 — Ivanti Connect Secure / Pulse Secure RCE Exploit

GitHub cross-source: 0x45dd/ivanti-cve-2026-104935-check: Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)

GitHub cross-source: ApexBreach/CVE-2026-104935-Proof-of-concept: Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)

Ivanti Connect Secure zero-day chain (CVE-2026-104935) got root on a fully patched 22.8R2.4 VPN from October 3, and Ivanti had fixed part of it on one branch in July — CVE-2026-104935 in Ivanti Connect Secure went public on October 13, and CISA added it to KEV the same day. Federal agencies have un…