Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway.
Excerpt from the primary source: BleepingComputer
Who is affected
Enterprises · Security professionals · Critical infrastructure
Affected technology: Ivanti Connect Secure / EPMM
Why it matters
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Ivanti Connect Secure / EPMM, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVE-2026-104935) is being actively exploited, CISA warns
CISA added CVE-2026-104935 (Ivanti Connect Secure) to its Known Exploited Vulnerabilities catalog on October 13, 2026, which means there is reliable evidence of exploitation in the wild. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CISA lists this as exploited in the wild. Unpatched Ivanti Connect Secure / EPMM systems are exposed to active attacks now.
Apply the vendor's security update for Ivanti Connect Secure / EPMM.
Windows 11 KB5127648 & KB5126653 cumulative updates released
Microsoft has released Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs and add new features.
Adobe Patches 140 Vulnerabilities Across 10 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge.
Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation processes to transmit data outside approved networks.