Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidentsFull incident
LiveHighPartly patchedPatch now

Day · Oct 26, 2026

Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Ivanti Connect Secure (ICS)

Follow this incident

Updates on Oct 26, 2026

  1. dbugs reports a dark-web seller offering a pre-auth RCE-to-root PoC for CVE-2026-104935 for $3,000 (seller claims tested on 25.1.1.1, 25.1.2.2 and 22.8R2.4; unverified).

Summary

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. One privilege-escalation piece of the chain was still being fixed at disclosure.

Read the full incident →

Advisories3

Sponsored

Buy sponsor slot · $149/mo