U.S.
CISA urges immediate patching for Ivanti Connect Secure appliances vulnerable to CVE-2026-104935, an authentication bypass scoring 8.6 on the CVSS scale.
Impacting multiple enterprise versions, the flaw enables unauthenticated remote command execution and is actively exploited in the wild for credential theft and data exfiltration.
The issue affects specific older versions of the software (versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier) and allows unknown parties to gain remote access without a password, executing commands on the system. According to CISA, the gap is already being exploited for identity theft and data extraction.
The agency added the issue to the list of known issues that are actively being exploited and gave US government agencies a strict deadline to implement the fixes by October 16, 2026. At the same time, it is recalled that version 22.8 reaches the end of its support on January 31, 2027.
What should those affected do?
If a breach is detected, experts recommend creating a backup, restoring factory settings, upgrading and resetting settings. It is also considered necessary to change passwords on all accounts, revoke stored certificates and reset digital access keys.
READ ALSO
Artificial intelligence created an attack for Chrome in six days
Attack attempts and detection by researchers
Research firms have documented dozens of attacks against decoy systems. As Ryan Dewhurst, head of Previdian, said, attackers test command execution by sending specific requests to the system.
In a separate report, Volexity said it had detected attacks that began on October 3, 2026, by a group of attackers known as UTA0576. This group exploited the issue in conjunction with an additional bug, gaining full access to systems for criminal purposes.
After entering, the perpetrators allegedly stole stored passwords, gathered network information, searched for administrator passwords, and attempted to cover their tracks by deleting log files and resetting the system state.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)