EN PT-BR
← Voltar ao feed
critical

CERT-FR Warns of Actively Exploited Ivanti Connect Secure Vulnerabilities Enabling RCE

1 fonte(s) · 1 atualização(ões) · publicado 01/11/2026 21:00 · coletado há 1 hora

CERT-FR issued advisory CERTFR-2026-AVI-1442 covering multiple vulnerabilities in Ivanti Connect Secure (ICS) that allow remote code execution, privilege escalation, and security policy bypass. Ivanti confirms that CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 are being actively exploited in the wild. Affected versions include ICS 22.8Rx prior to 22.8R2.6, 25.1.1.x prior to 25.1.1.3, and 25.1.2.x prior to 25.1.3.1. Ivanti notes that version 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527. This advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-013) issued on 13 October 2026 regarding CVE-2026-104935.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1442 covers several flaws in Ivanti Connect Secure (ICS) that let an attacker run arbitrary code remotely, escalate privileges and bypass the security policy. Ivanti says CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are all being actively exploited. The articles do not say which CVE causes which impact, nor what access or authentication an attacker needs. Affected: ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3 and 25.1.2.x before 25.1.3.1. Ivanti says 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527.

Como foi descoberta

The source is the CERT-FR advisory of 2 November 2026, which relays Ivanti's statement that the three CVEs are exploited in the wild. Exploitation of CVE-2026-104935 had already been flagged earlier: Ivanti published a security bulletin on 13 October 2026, and CERT-FR issued alert CERTFR-2026-ALE-013 the same day. The articles do not say who found the flaws or how they were reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 14:20.

Detalhes técnicos

  • CVE-2026-104935, CVE-2026-111357, CVE-2026-118527: actively exploited, impacting RCE, privilege escalation, and security policy bypass in Ivanti Connect Secure.
  • Affected: ICS 22.8Rx < 22.8R2.6, 25.1.1.x < 25.1.1.3, 25.1.2.x < 25.1.3.1.
  • ICS 25.1.3.x unaffected by CVE-2026-111357 and CVE-2026-118527.

Remediação

  • Apply patches referenced in Ivanti's official security bulletins for each CVE.
  • Refer to CERT-FR alert CERTFR-2026-ALE-013 (13 October 2026) for prior guidance on CVE-2026-104935.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 01/11/2026 21:00 · coletado 04/11 14:01 primeiro registro

    CERT-FR Warns of Actively Exploited Ivanti Connect Secure Vulnerabilities Enabling RCE

    ler a análise desta fonte

    CERT-FR issued advisory CERTFR-2026-AVI-1442 covering multiple vulnerabilities in Ivanti Connect Secure (ICS) that allow remote code execution, privilege escalation, and security policy bypass. Ivanti confirms that CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 are being actively exploited in the wild. Affected versions include ICS 22.8Rx prior to 22.8R2.6, 25.1.1.x prior to 25.1.1.3, and 25.1.2.x prior to 25.1.3.1. Ivanti notes that version 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527. This advisory follows an earlier CERT-FR alert (CERTFR-2026-ALE-013) issued on 13 October 2026 regarding CVE-2026-104935.

    Technical Details

    • CVE-2026-104935, CVE-2026-111357, CVE-2026-118527: actively exploited, impacting RCE, privilege escalation, and security policy bypass in Ivanti Connect Secure.
    • Affected: ICS 22.8Rx < 22.8R2.6, 25.1.1.x < 25.1.1.3, 25.1.2.x < 25.1.3.1.
    • ICS 25.1.3.x unaffected by CVE-2026-111357 and CVE-2026-118527.

    Remediation

    • Apply patches referenced in Ivanti's official security bulletins for each CVE.
    • Refer to CERT-FR alert CERTFR-2026-ALE-013 (13 October 2026) for prior guidance on CVE-2026-104935.