Ivanti patches exploited Connect Secure zero-day CVE-2026-104935 (UTA0576); CISA adds it to KEV; six Xtraction and Intune flaws fixed
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…