Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidentsFull incident
LiveHighPartly patchedPatch now

Day · Oct 29, 2026

Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Ivanti Connect Secure (ICS)

Follow this incident

Updates on Oct 29, 2026

  1. CISA adds CVE-2026-111357, the chain's root privilege-escalation step (dsinvoked trusts DSCache configuration data on 22.8R2.4), to KEV.

Summary

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. The chain's privilege-escalation piece, CVE-2026-111357 (dsinvoked trusting DSCache data, root on 22.8R2.4), was added to CISA KEV on Oct 29.

Read the full incident →

Advisories4

Sponsored

Buy sponsor slot