Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Hi, what are you looking for?

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained witha vulnerabilitythe company disclosed last month.The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13advisorydescribing CVE-2026-104935, an authentication bypass in the VPN product.According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13advisorydescribing CVE-2026-104935, an authentication bypass in the VPN product.According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.Advertisement. Scroll to continue reading.The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

CISA addedthe two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

CVE-2026-104935 has been in the KEV catalog since October 13.Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Volexityuncovered the in-the-wild exploitationwhile investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however,reportedthat attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Related:Fresh WordPress Vulnerability in Attackers’ CrosshairsRelated:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Related:Drupal Commerce Core Vulnerability Exploited Against Online StoresRelated:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Related:PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.