[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhX_dedRn0fQDfPwyRAHuckhk_wpr_taDYYx3d_jO104":3},{"article":4,"iocs":57,"watch_terms":65,"solutions":66,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9970a271-dc90-4fe5-ac1e-7d682889b269","CISA warns admins to immediately fix Ivanti flaw exploited as zero-day","cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day-e05ffd","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]","CISA has issued an urgent warning for Ivanti Connect Secure (ICS) systems, highlighting a critical authentication bypass vulnerability (CVE-2026-104935) being exploited as a zero-day since at least October 1st. Threat actor UTA0576 is chaining this flaw with others to achieve unauthenticated root-level code execution, targeting Active Directory credentials and sensitive data. CISA has ordered federal agencies to patch immediately and advised all organizations to update and investigate for signs of compromise.","CISA warns of Ivanti Connect Secure zero-day flaw exploited by UTA0576.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F14\u002FIvanti.jpg","2026-10-14T12:58:07+00:00","2026-10-14T14:00:19.485493+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"Active Directory","technology",{"name":30,"type":19},"LAPS","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58,62],{"type":59,"value":60,"context":61},"cve","CVE-2026-104935","Authentication bypass and command execution vulnerability in Ivanti Connect Secure.",{"type":59,"value":63,"context":64},"CVE-2023-46805","Previous authentication bypass vulnerability in Ivanti Connect Secure.",[21,18,30],{"controls":67,"vendors":152},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":98,"name":99,"problem":100,"products":101},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":127,"name":128,"problem":129,"products":130},"patch-management","Automated patch management","Known holes get closed in days, not months.",[131,136,144],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":132,"product_name":133,"url":134,"description":135},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[153,159],{"slug":154,"name":155,"logo_path":156,"roles":157},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png",[158],"reported_by",{"slug":160,"name":21,"logo_path":161,"roles":162},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[163],"affected",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"ivanti-zero-day-exploited-for-root-level-access-patch-immediately","Ivanti Zero-Day Exploited for Root-Level Access — Patch Immediately","A critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure is being actively exploited as a zero-day by threat actor UTA0576, who chains it with additional flaws to achieve unauthenticated root-level code execution. The attack has been ongoing since at least October 1st, giving adversaries significant dwell time to harvest Active Directory credentials and exfiltrate sensitive data before defenders were alerted. This incident underscores the danger of unpatched internet-facing VPN and remote access appliances, which serve as high-value entry points into enterprise networks. CISA's emergency directive to federal agencies reflects the severity of the risk, and all organizations — public and private — should treat this as a critical, time-sensitive threat.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST SC-7: Boundary Protection (Network Segmentation)","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL: Problem Management \u002F Change Management (Emergency Change)","GDPR Article 32: Security of Processing (breach risk from credential exposure)",{}]