highlivepartial fix
day · Oct 13, 2026
Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root
› Ivanti Connect Secure (ICS)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
Updates on Oct 13, 2026
Ivanti discloses and patches CVE-2026-104935; Volexity publishes.
CISA KEV listing; federal patching deadline reported as Oct 16.
## summary
Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.
read the full incident →
