Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidentsFull incident
LivePatchedPatch now

Day · Oct 30, 2026

Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for root

Ivanti Connect Secure (ICS)

Follow this incident

Updates on Oct 30, 2026

  1. CISA adds CVE-2026-111357 (missing authentication for critical function) and CVE-2026-118527 (predictable identifiers) to KEV based on evidence of active exploitation, so every piece of the chain is now on the catalog.

Summary

Volexity observed threat actor UTA0576 chaining an Ivanti Connect Secure authentication-bypass / RCE zero-day (CVE-2026-104935) with additional flaws from about Oct 1–3 2026 to get unauthenticated root on fully patched appliances, re-exploiting in memory without planting webshells. Ivanti patched CVE-2026-104935 on Oct 13; CISA added it to KEV. The chain's privilege-escalation piece, CVE-2026-111357 (dsinvoked trusting DSCache data, root on 22.8R2.4), was added to CISA KEV on Oct 29. On Oct 29 Ivanti also fixed it and the chain's predictable-filename upload bug (CVE-2026-118527) in 25.1.1.3 and 22.8R2.6, so every exploited flaw in the chain now has a fix; patching does not remove an existing compromise.

Read the full incident →

Advisories5

Sponsored

Buy sponsor slot