[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOA0cX3Mkdmiz4m43RiPZOnLmXctioHph0XW6X9qWtN0":3},{"article":4,"iocs":52,"watch_terms":71,"solutions":72,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"eb99244b-2cd8-4447-898e-3f4db4e7cee4","Ivanti warns of Connect Secure zero-day exploited in attacks","ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks-0dfe31","Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]","Ivanti has issued an urgent warning about a critical zero-day vulnerability (CVE-2026-104935) in its Connect Secure remote access gateway. This high-severity authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands with low complexity. The company is aware of limited exploitation in the wild and urges customers to patch immediately.","Ivanti warns of actively exploited zero-day in Connect Secure gateway.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fivanti-warns-of-connect-secure-zero-day-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F13\u002FIvanti.jpg","2026-10-13T15:45:50+00:00","2026-10-13T16:00:14.286147+00:00",9,[17,20,23,26],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"SSL VPN","technology",{"name":27,"type":28},"China-linked cyber spies","threat_actor","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":29,"icon":31,"name":32,"slug":33},null,"Zero-day","zero-day",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60,63,66,69],{"type":54,"value":55,"context":56},"cve","CVE-2026-104935","Zero-day authentication bypass vulnerability in Ivanti Connect Secure",{"type":54,"value":58,"context":59},"CVE-2023-46805","Previously exploited authentication bypass in Ivanti Connect Secure",{"type":54,"value":61,"context":62},"CVE-2024-21887","Previously exploited command injection in Ivanti Connect Secure",{"type":54,"value":64,"context":65},"CVE-2024-21893","Previously exploited server-side request forgery in Ivanti Connect Secure",{"type":54,"value":67,"context":68},"CVE-2025-0282","Previously exploited remote code execution in Ivanti Connect Secure",{"type":54,"value":70,"context":68},"CVE-2025-22457",[21,18],{"controls":73,"vendors":160},[74,103,132],{"slug":75,"name":76,"problem":77,"products":78},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":104,"name":105,"problem":106,"products":107},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":133,"name":134,"problem":135,"products":136},"patch-management","Automated patch management","Known holes get closed in days, not months.",[137,144,152],{"vendor_slug":138,"vendor_name":21,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[161],{"slug":138,"name":21,"logo_path":139,"roles":162},[163],"affected",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":179},"ivanti-connect-secure-zero-day-exploited-in-the-wild","Ivanti Connect Secure Zero-Day Exploited in the Wild","A critical authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935) allows unauthenticated attackers to execute arbitrary commands without requiring any credentials, representing one of the most severe risk profiles possible for an internet-facing gateway. The root cause lies in a failure of authentication enforcement logic, meaning the access control boundary that should protect the device can be entirely circumvented. Because Connect Secure is a remote access gateway, exploitation can serve as an entry point to the broader corporate network, amplifying the blast radius significantly. Zero-day vulnerabilities like this underscore the danger of delaying patch cycles, particularly for perimeter-facing devices that are directly reachable from the internet.",[169,170,171,172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-17: Remote Access","NIST RA-5: Vulnerability Monitoring and Scanning","CISA KEV (Known Exploited Vulnerabilities) Catalog","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Emergency Change process",{}]