Ivanti patches exploited Connect Secure zero-day CVE-2026-104935 (UTA0576); CISA adds it to KEV; six Xtraction and Intune flaws fixed
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 22/10/2026 00:06; os links antigos trazem para cá.
Fontes: cert.ssi.gouv.fr ↗ cisa.gov ×2 ↗ darkwebinformer.com ↗ darkreading.com ↗ theregister.com ↗
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which tracks the previously unknown attacker as UTA0576 and suspects a criminal rather than espionage motive. Ivanti confirmed limited exploitation against a small number of customers (theregister.com). On 13 October 2026 CISA added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog, together with the Windows command injection flaw CVE-2026-96951, citing use for credential theft and data exfiltration (cisa.gov). CERT-FR published advisory CERTFR-2026-AVI-1311 on 14 October 2026 (cert.ssi.gouv.fr). Volexity described a chain of three vulnerabilities, and the third, a privilege escalation bug, is still unpatched, with a fix promised "in the coming weeks" (theregister.com). The same cycle fixes six other flaws in Neurons Patch for Intune and Xtraction, including two with CVSS 9.9 that expose credentials. Ivanti says only the Connect Secure flaw is known to be exploited (darkwebinformer.com, cert.ssi.gouv.fr). Shadowserver was tracking more than 5,500 internet-exposed Connect Secure appliances (darkwebinformer.com). This is the third consecutive year Ivanti has handled exploited Connect Secure zero-days (theregister.com).
Entenda a falha
A vulnerabilidade
CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure (CVSS 8.6 per The Register). A remote, unauthenticated attacker can run arbitrary commands, with no user interaction. It is exploited in the wild. Affected: 22.8R2.4 and earlier, 25.1.1.1 and earlier, 25.1.2.2 and earlier (CISA); CERT-FR lists branches before 22.8R2.5, 25.1.1.2 and 25.1.3.1, which are the fixed releases. The same cycle fixes CVE-2026-109412 (CVSS 9.9, Neurons Patch for Intune cloud, authenticated access to authentication data, fixed server-side on 16 September) and CVE-2026-106042 (CVSS 9.9, Xtraction, authenticated attacker captures EPMM connector credentials). Xtraction 2026.2.1 and earlier is also hit by CVE-2026-106047 (path traversal file read), CVE-2026-106043 (unauthenticated trusted-site change), CVE-2026-106034 (directory modification) and CVE-2026-106035 (SQL passwords in logs); fixed in 2026.4. A third flaw in the Connect Secure chain, privilege escalation, is still unpatched.
Como funciona
According to Volexity, the attack on Connect Secure is a chain of three vulnerabilities. A remote request first abuses the spoofing weakness to get past authentication on the appliance. The second stage then gives remote command execution, and the third, still unpatched, escalates privileges. The updates fix the first two stages. The attacker's commands run in memory and are sent repeatedly through the exploit channel, using only tools already on the appliance, with no malware or web shells dropped. That is why Ivanti's Integrity Checker Tool may miss it. The articles do not detail the internal code path.
Por que é vulnerável
The Connect Secure flaw is classified as authentication bypass by spoofing: the appliance can be made to accept a request as authenticated when it should not. The articles do not say which check is missing. Ivanti said it had identified only a portion of the vulnerability and patched it in the July 25.1.3.0 update, and was backporting that fix to other branches when exploitation began, so the earlier fix was partial and left an opening. The October updates fix the authentication bypass and remote code execution stages. For the Xtraction and Intune flaws, the articles describe only the effects, such as request redirection, path traversal and credentials in logs, not root causes.
Como foi descoberta
Volexity discovered CVE-2026-104935 while investigating intrusions by a previously unknown actor it tracks as UTA0576, suspected to be criminal rather than espionage. Ivanti said it was aware of exploitation affecting a limited number of customers at disclosure. It had patched part of the flaw in July and was still backporting when attacks began. Ivanti disclosed it on 13 October 2026 in a security advisory, and CISA added it to the KEV catalog the same day. Volexity suspects the attacker used large language models. Ivanti was not aware of compromise through the Intune or Xtraction flaws.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 00:21.
Detalhes técnicos
- CVE-2026-104935 (CVSS 8.6 per theregister.com) is an authentication bypass by spoofing leading to remote command execution. It needs no credentials or user interaction. The updates fix the authentication bypass and remote code execution stages of the chain (theregister.com, darkwebinformer.com).
- In July 2026 Ivanti patched part of the vulnerability in the 25.1.3.0 update and was backporting the fix when exploitation began (theregister.com).
- The third flaw in the chain is a separate privilege escalation bug that remains unpatched (theregister.com).
- CISA points to Volexity's blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" for further context (cisa.gov).
- Commands execute in memory, so Ivanti's Integrity Checker Tool may not detect exploitation. Determining compromise requires network and memory forensics (cisa.gov).
- UTA0576 deployed no malware and no web shells. It repeatedly ran commands through the exploit channel and used only commands available on the ICS appliance. It also used highly specific scripts with hardcoded credentials, and Volexity suspects it used large language models to support its operations (theregister.com).
- Post-exploitation activity pointed to credential theft, data exfiltration, log tampering and network reconnaissance, apparently preparing lateral movement and a broader compromise. The operation was detected and disrupted, so the attacker's final objectives are unknown, and few IOCs are available (theregister.com). CISA's alert names no actor, gives no victim information and no IOCs (cisa.gov).
- Connect Secure version 22.8 reaches end of life on 31 January 2027 (cisa.gov).
- CVE-2026-96951: Microsoft Windows command injection vulnerability, added to KEV on 13 October 2026. No affected versions or exploitation methods were published (cisa.gov).
- CVE-2026-109412 (CVSS 9.9, Neurons Patch for Intune cloud service): a remotely authenticated attacker can access sensitive authentication information. The fix was deployed to all Neurons Patch for Intune cloud environments on 16 September 2026, and Neurons for UEM was also updated automatically (darkwebinformer.com, cert.ssi.gouv.fr).
- CVE-2026-106042 (CVSS 9.9, Xtraction): an authenticated attacker can redirect application requests to an attacker-controlled server and capture EPMM connector credentials (darkwebinformer.com).
- Other Xtraction flaws (darkwebinformer.com):
- CVE-2026-106047: arbitrary file read via path traversal (authenticated).
- CVE-2026-106043: unauthenticated creation or modification of a trusted site.
- CVE-2026-106034: directory modification (authenticated).
- CVE-2026-106035: SQL passwords exposed in application logs.
- Ivanti was not aware of customer compromise through the Intune or Xtraction flaws, and no public proof-of-concept exploits had been confirmed for them (darkwebinformer.com).
- Xtraction 2026.2.1 and earlier is affected (darkwebinformer.com).
- Affected Connect Secure versions per CERT-FR: 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2 and 25.1.3.x before 25.1.3.1 (cert.ssi.gouv.fr). CISA lists 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior (cisa.gov).
- CERT-FR gives no IOCs, attribution or exploitation details (cert.ssi.gouv.fr).
Remediação
- Upgrade Connect Secure to a fixed release: 22.8R2.5, 25.1.1.2 or 25.1.3.1 (cert.ssi.gouv.fr). Prioritise these appliances because of the active exploitation. CISA urges immediate update per Ivanti's advisory and recommends reviewing the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide (cisa.gov).
- Run the Ivanti Integrity Checker Tool regularly and check appliances for compromise using Volexity's report (theregister.com, darkwebinformer.com). Do not rely on it alone: CISA warns it may miss in-memory exploitation, so add network and memory forensics (cisa.gov).
- If compromise is suspected, follow the Ivanti Connect Secure Recovery Procedures: back up the appliance configuration, factory reset and upgrade (for cloud and virtual systems, rebuild the instance and upgrade), then restore the configuration from the backup (cisa.gov).
- Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials (cisa.gov).
- Watch for the upcoming patch for the unpatched privilege escalation flaw (theregister.com).
- Plan migration off version 22.8 before its end of life on 31 January 2027 (cisa.gov).
- Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, and meet its expectations for checking whether a system was compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation (cisa.gov).
- For CVE-2026-96951 no specific patch guidance is given; consult the vendor advisory (cisa.gov).
- Neurons Patch for Intune needs no update, but rotate the client secret of the Microsoft Entra ID application registration used for Intune publication (darkwebinformer.com).
- Upgrade Xtraction to 2026.4 or later and rotate any EPMM connector credentials the application uses (darkwebinformer.com, cert.ssi.gouv.fr).
Relatos divergentes
- Affected Connect Secure ranges: darkwebinformer.com and cisa.gov list 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. cert.ssi.gouv.fr lists 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2 and 25.1.3.x before 25.1.3.1. The branch lists differ (notably 25.1.3.x appears only in the CERT-FR list), so confirm against the Ivanti advisory.
- Product naming: darkwebinformer.com refers to Neurons Patch for Intune, while cert.ssi.gouv.fr refers to Neurons for UEM, updated automatically on 16 September 2026.
- Detection: theregister.com and darkwebinformer.com point to the Integrity Checker Tool for compromise checks, while cisa.gov (the more recent and authoritative source on this point) warns it may not detect in-memory exploitation.
- Attribution: cisa.gov names no threat actor, whereas theregister.com reports Volexity's attribution to UTA0576, with a suspected criminal motive.
Linha do tempo
-
Ivanti October 2026 updates fix multiple flaws; CVE-2026-104935 in Connect Secure actively exploited
ler a análise desta fonte ocultar
CERT-FR advisory CERTFR-2026-AVI-1311 reports multiple vulnerabilities in Ivanti products, covering Connect Secure (ICS), Neurons for UEM and Xtraction. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. Ivanti states that CVE-2026-104935 is being actively exploited. The fixes were published in the Ivanti October 2026 security update of 13 October 2026.
Technical Details
- Affected: Connect Secure (ICS) 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2 and 25.1.3.x before 25.1.3.1.
- Affected: Xtraction versions before 2026.4.
- Neurons for UEM was updated automatically on 16 September 2026.
- The advisory lists these CVEs: CVE-2026-104935, CVE-2026-106034, CVE-2026-106035, CVE-2026-106042, CVE-2026-106043, CVE-2026-106047 and CVE-2026-109412.
- Only CVE-2026-104935 is reported as exploited. It has a dedicated Ivanti Connect Secure advisory.
- The article gives no IOCs, attribution or exploitation details.
Remediation
- Apply the fixed versions listed in the Ivanti security bulletins: ICS 22.8R2.5, 25.1.1.2 or 25.1.3.1, and Xtraction 2026.4 or later.
- Prioritise Connect Secure appliances because of the active exploitation.
- Refer to the Ivanti advisories for CVE-2026-104935, Neurons Patch for Intune and Xtraction for full patch details.
-
Ivanti Connect Secure zero-day CVE-2026-104935 exploited for unauthenticated RCE, credential theft and data exfiltration; added to CISA KEV
ler a análise desta fonte ocultar
CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026 and urges immediate patching. The article does not attribute the activity to a named actor.
Technical Details
- Affected versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
- Threat actor commands execute in memory, so Ivanti's Integrity Checker Tool may not detect exploitation. Determining compromise requires network and memory forensics.
- CISA points to the Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" for further context.
- Version 22.8 reaches end of life on Jan. 31, 2027.
Remediation
- Immediately update to the latest version per Ivanti's Security Advisory for CVE-2026-104935, and review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
- If compromise is suspected, follow the Ivanti Connect Secure Recovery Procedures: back up the appliance configuration, factory reset and upgrade (for cloud and virtual systems, rebuild the instance and upgrade), then restore the configuration from the backup.
- Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.
-
CISA adds Microsoft Windows CVE-2026-96951 and Ivanti Connect Secure CVE-2026-104935 to KEV catalog over active exploitation
ler a análise desta fonte ocultar
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-96951, a command injection flaw in Microsoft Windows, and CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2026-96951: Microsoft Windows Command Injection Vulnerability.
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability.
- The article does not list affected versions or exploitation methods.
Remediation
- Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
- BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
- CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
- The article gives no specific patch or mitigation guidance; consult the vendor advisories.
-
Ivanti patches exploited Connect Secure zero-day CVE-2026-104935 and six flaws in Neurons Patch for Intune and Xtraction
Beyond the Connect Secure zero-day already covered, this article reports six additional Ivanti vulnerabilities fixed in the same release cycle: CVE-2026-109412 in Neurons Patch for Intune (CVSS 9.9, cloud fix deployed September 16, client secret rotation advised) and five Xtraction flaws including CVE-2026-106042 (CVSS 9.9, EPMM connector credential capture), fixed in Xtraction 2026.4. It also gives the affected Connect Secure version ranges, the Shadowserver count of more than 5,500 exposed appliances, and Ivanti's statement that only the Connect Secure flaw is known to be exploited.
ler a análise desta fonte ocultar
Beyond the Connect Secure zero-day already covered, this article reports six additional Ivanti vulnerabilities fixed in the same release cycle: CVE-2026-109412 in Neurons Patch for Intune (CVSS 9.9, cloud fix deployed September 16, client secret rotation advised) and five Xtraction flaws including CVE-2026-106042 (CVSS 9.9, EPMM connector credential capture), fixed in Xtraction 2026.4. It also gives the affected Connect Secure version ranges, the Shadowserver count of more than 5,500 exposed appliances, and Ivanti's statement that only the Connect Secure flaw is known to be exploited.
Ivanti released security updates for an actively exploited Connect Secure zero-day, CVE-2026-104935, and six other vulnerabilities in Neurons Patch for Intune and Xtraction. CVE-2026-104935 is a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands, and Ivanti confirmed limited exploitation. Two further flaws carry CVSS 9.9 scores and expose credentials: CVE-2026-109412 in Neurons Patch for Intune and CVE-2026-106042 in Xtraction. Ivanti said it was not aware of customer compromise through the Intune or Xtraction flaws and that no public proof-of-concept exploits had been confirmed for them. Shadowserver was tracking more than 5,500 internet-exposed Connect Secure appliances when the vulnerability was reported.
Technical Details
- CVE-2026-104935 affects Connect Secure 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. It requires no credentials or user interaction.
- CVE-2026-109412 (CVSS 9.9) lets a remotely authenticated attacker access sensitive authentication information in the cloud service Neurons Patch for Intune. Ivanti deployed the fix to all cloud environments on September 16.
- CVE-2026-106042 (CVSS 9.9) lets an authenticated attacker redirect Xtraction application requests to an attacker-controlled server and capture EPMM connector credentials.
- Other Xtraction flaws:
- CVE-2026-106047: arbitrary file read via path traversal (authenticated).
- CVE-2026-106043: unauthenticated creation or modification of a trusted site.
- CVE-2026-106034: directory modification (authenticated).
- CVE-2026-106035: SQL passwords exposed in application logs.
- Xtraction 2026.2.1 and earlier is affected.
Remediation
- Install the fixed Connect Secure release listed in Ivanti's security advisory and run the Integrity Checker Tool regularly.
- For Neurons Patch for Intune, no update is needed, but rotate the client secret of the Microsoft Entra ID application registration used for Intune publication.
- Upgrade Xtraction to version 2026.4 and rotate any EPMM connector credentials the application uses.
-
Ivanti patches Connect Secure zero-day CVE-2026-104935 exploited in the wild by new actor UTA0576
ler a análise desta fonte ocultar
Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw (CVSS 8.6) discovered by Volexity that lets remote, unauthenticated attackers execute arbitrary commands. Ivanti confirmed exploitation in the wild against a limited number of customers at the time of disclosure. Volexity tracks the previously unknown attacker as UTA0576 and suspects a criminal rather than espionage motive. Post-exploitation activity pointed to credential theft, data exfiltration, log tampering and network reconnaissance, apparently in preparation for lateral movement and a broader compromise. This is the third consecutive year Ivanti has had to handle exploited Connect Secure zero-days.
Technical Details
- Volexity described a chain of three vulnerabilities. The updates fix the authentication bypass and remote code execution stages, which fall under CVE-2026-104935.
- The third flaw is a separate privilege escalation bug that remains unpatched. Ivanti plans a fix "in the coming weeks".
- Ivanti says it identified part of the vulnerability and patched it in the July 25.1.3.0 update, and was backporting the fix when exploitation began.
- The attackers deployed no malware and no web shells. They repeatedly ran commands through the exploit channel and used only commands available on the ICS appliance.
- They also used highly specific scripts with hardcoded credentials. Volexity suspects they used large language models to support their operations.
- Few indicators of compromise are available so far. The operation was detected and disrupted, so the attacker's final objectives are unknown.
Remediation
- Update Connect Secure to the fixed releases listed in the Ivanti advisory.
- Run the Ivanti Integrity Checker Tool regularly.
- Check appliances for compromise using Volexity's report.
- Watch for the upcoming patch for the privilege escalation flaw.