SvertokSearch

Security & FraudPublished:

CISA urges immediate Ivanti Connect Secure updates after active exploitation

Attackers can run commands without authenticating, and Ivanti’s Integrity Checker Tool may miss evidence when those commands execute in memory.

A rust ribbon passes through an open geometric gateway and remains faintly visible inside as a gold inspection beam crosses the structure beside a sage patch panel.

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities Catalog on Oct. 13, 2026, after reporting active exploitation of Ivanti Connect Secure. The affected releases are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.

The zero-day flaw bypasses authentication, allowing a remote attacker to execute commands without signing in. CISA says threat actors have used that access for credential theft and data exfiltration.

Why a routine integrity check may fall short

CISA urges affected organizations to update immediately to the latest version and consult Ivanti’s advisory and deployment guidance. Version 22.8 is scheduled to reach end of life on Jan. 31, 2027.

Organizations investigating possible compromise need network and memory forensics. CISA warns that Ivanti’s Integrity Checker Tool may not find evidence of this exploit because attacker commands can execute in memory.

For a suspected compromise, CISA recommends following Ivanti’s recovery procedures, including these steps:

  • Back up the appliance configuration.
  • Reset passwords for all accounts, including domain, administrator and local accounts.
  • Revoke and reissue stored certificates, then reset stored API keys and license-server credentials.

Next story

US agencies warn Integrity Tech supports attacks on critical infrastructure

A quiet shadow path enters an infrastructure building through a partly open exterior edge-device doorway.

CISA, the FBI, the NSA and international partners tied the activity to edge-device access, botnets and infrastructure used for long-term network intrusion.

Published October 14, 2026Source: CISA

CISA adds exploited Cisco SD-WAN Manager flaw to its priority catalog

A rust-colored route crosses the boundary of a layered navy network console and ends at a gold repair block.

Cisco says CVE-2026-76504 can let an unauthenticated remote attacker access Catalyst SD-WAN Manager as an administrator.

Published October 11, 2026Source: CISA

CISA flags a FortiMail path-traversal flaw as actively exploited

A cream envelope follows an angular route through mail compartments before a rust-colored repair block stops it.

CISA lists CVE-2026-104286 as exploited; Fortinet says crafted web requests can write files on affected FortiMail releases and publishes the fixed versions.