10 casos · pág. 1/1
CERT-FR advisory CERTFR-2026-AVI-1311 reports multiple vulnerabilities in Ivanti products, covering Connect Secure (ICS), Neurons for UEM and Xtraction. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. Ivanti states that CVE-2026-104935 is bein…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-96951, a command injection flaw in Microsoft Windows, and CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure. CISA describes these vulnerability types as a frequent attack vecto…
CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. …
TrendAI™ (Trend Micro) published its H1 2026 APT Activity Roundup on July 29, 2026. It finds nation-state actors used AI in more stages of the intrusion lifecycle than in any prior half-year the company has tracked. China-aligned actors used generative AI to refine exploits and iteratively build malware through "vibe coding", and one AI a…
Ivanti released security updates for an actively exploited Connect Secure zero-day, CVE-2026-104935, and six other vulnerabilities in Neurons Patch for Intune and Xtraction. CVE-2026-104935 is a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands, and Ivanti confirmed limited exploit…
A zero-day vulnerability in BeyondTrust Remote Support is being reported as the latest in a run of edge-device bugs under attack. In the same week, vulnerabilities in edge products from Ivanti, Cisco and Palo Alto Networks also came under fire. The article, which is very brief, frames BeyondTrust as joining this group and as continuing th…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
GreyNoise analyzed 147.8 million sessions over 103 days across 276 vendor-specific tags covering 18 network infrastructure vendors. It found that surges in scanning and exploitation activity regularly precede vendor advisories. Of 104 detected surges, 68 preceded a vendor-matched CVE (33 vulnerabilities across 16 vendor families), with a …
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
FortiGuard Labs describes ClingSTUN, a Linux back-connect proxy backdoor that keeps persistent access and turns compromised devices into remotely controlled proxy nodes. It combines persistence, process termination, watchdog manipulation and remote command execution. It also uses legitimate public STUN servers for NAT traversal, to discov…
