Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2026-104935 in Ivanti Connect Secure went public on October 13, and CISA added it to KEV the same day. Federal agencies have until October 16. Volexity found it while working an incident at a customer. The actor, which it tracks as UTA0576, started on October 3 against an appliance running 22.8R2.4, the fully patched build at the time.

The way in is welcome.cgi, the public login page. A request to it can carry a header naming a script that sits behind the login, and that script runs. A race in the wu.cgi upload handler turns that into code execution, and a third bug in the dsinvoked service gets root. Ivanti’s patch covers the first two (on the 22.8 line that’s 22.8R2.5, per SecurityWeek). The root escalation is still open.

Once in, the actor used the appliance’s own AD service account to search for LAPS passwords and BitLocker recovery keys. Volexity says Ivanti’s Integrity Checker Tool doesn’t detect it, because the exploit patches a library in memory and then puts it back. CISA wrote the same about that tool in February 2024, after the CVE-2023-46805 attacks.

Ivanti told CyberScoop it found a portion of this bug in internal checks in June, and that it “did not meet the threshold for an out-of-band release.” Rapid7 quotes Ivanti saying that portion was fixed in 25.1.3.0 in July. The exploitation started while the backport to the older lines was still in progress.

The WordPress version of that public page is wp-login.php, sitting at the same default path on every install.

CISA’s alert also says 22.8, the line Volexity saw hit, reaches end of life on January 31, 2027. If Ivanti knew about part of this bug in June and shipped the fix to one branch in July, who should get to decide that everyone on the other branches can wait for the normal release cycle?

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

This week’s list is a little Windows-heavy thanks to June Patch Tuesday. Four of the five are already on CISA’s KEV list, the DHCP flaw can be triggered from the local network, and Oracle had to release an out-of-band fix for a PeopleSoft zero-day that was already being used in attacks.

1. CVE-2026-44815: Windows DHCP Client

A malicious DHCP server on the same network can send a crafted response and get code execution on Windows clients. That makes this more important than a normal workstation patch, especially on guest Wi-Fi, branch networks, or anywhere you don’t fully trust the local segment.

Scope: Windows systems using DHCP Why now: Critical, KEV-listed, CISA deadline June 23 Next step: Deploy the June 2026 Windows updates

2. CVE-2026-35273: Oracle PeopleSoft PeopleTools

Unauthenticated RCE that attackers were already using for data theft before Oracle released the fix. Any exposed or affected PeopleSoft server deserves both a patch and a closer look at what happened before it was patched.

Scope: PeopleTools 8.61 and 8.62 Why now: CVSS 9.8, KEV-listed, CISA deadline July 3 Next step: Apply Oracle’s out-of-band update and check for signs of post-exploitation activity

3. CVE-2026-0257: Palo Alto PAN-OS GlobalProtect

An authentication bypass that allows attackers to establish GlobalProtect VPN sessions without valid credentials. Since this sits at the front door of the networks running a Palo fw, log review matters almost as much as installing the fix.

Scope: Exposed GlobalProtect portals and gateways Why now: Active exploitation confirmed by Unit 42 on June 9 Next step: Apply the appropriate PAN-OS hotfix and investigate any VPN sessions you can’t explain

4. CVE-2026-10520 / CVE-2026-10523: Ivanti Sentry

This is a rough pair: one flaw allows unauthenticated root RCE, while the other can be used to create a rogue administrator account. Either one would justify urgent work on its own.

Scope: Ivanti Sentry gateway deployments Why now: CVSS 10.0 and 9.9; both KEV-listed Next step: Upgrade to the fixed release in Ivanti’s advisory

5. CVE-2026-47288: Windows Kerberos KDC

Critical RCE in the Windows Kerberos Key Distribution Center, putting domain controllers in the blast radius. There is no confirmed exploitation listed here yet, but the affected role makes delaying it a hard sell.

Scope: Windows Server domain controllers Why now: Critical, released with June 2026 Patch Tuesday Next step: Roll out the June updates, with domain controllers handled early

I try to limit these posts to 5 CVE's so it doesn't get too long, but feel free to discuss anything that missed the cut down in the comments!