A lot of shops patched Ivanti Connect Secure in mid-October and moved on. That patch fixed the authentication bypass, CVE-2026-104935, and it turns out the bypass was only the first step of the chain. Two more vulnerabilities came out afterwards, and the update that covers all three arrived on Oct 29: versions 22.8R2.6 and 25.1.1.3.

The bigger problem is CVE-2026-111357. It needs no authentication at all, and it gives the attacker root on the appliance. Ivanti scores it 8.8. The third flaw, CVE-2026-118527, is a file upload issue with a predictable filename, and it scores 4.3. CISA added both to the KEV catalog on Oct 30. The deadline for the root flaw is today, Nov 2. The upload flaw is due on Nov 13.

The vulnerable versions are 25.1.1.2 and earlier, plus 22.8R2.5 and earlier. Anything running 22.7.x or lower is not affected by the two new flaws.

Attackers have been using this chain since Oct 3, weeks before the last two flaws became public. Volexity tracks the actor as UTA0576. The group has hit appliances that were fully patched, and it goes after the Active Directory material the appliance holds, including LAPS passwords and BitLocker recovery keys.

So the update alone is not the whole response. Ivanti's Integrity Checker can miss what these attacks leave in memory, so a clean scan does not clear the box. If you suspect an appliance was hit, the guidance is a factory reset, plus rotation of every credential and certificate it held.

Sources: Ivanti security advisory for Connect Secure (updated Oct 29); CISA KEV entries for CVE-2026-111357 and CVE-2026-118527 (added Oct 30); Volexity reporting on UTA0576 activity.

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

I’ve been through CISA's Known Exploited list for Oct 8-16 and pulled out what matters for small-office and SMB environments.

Patch now: \- Ivanti Connect Secure CVE-2026-104935: auth bypass to RCE. If it's on your edge, patch and assume compromise until you've worked through CISA's guidance. \- Windows Shell CVE-2026-96951: Mark of the Web bypass, fixed in this month's Patch Tuesday. Push it to anything that opens email attachments. \- PAN-OS CVE-2026-0322: urgent if the management interface is reachable from anywhere it shouldn't be. \- Cisco Secure Email Gateway CVE-2026-76519: AMP path. Check your version against Cisco's advisory.

Batch: \- FortiOS CVE-2025-61624: path traversal, but needs admin access first. Roll it into your next window. \- ProFTPD mod\copy CVE-2015-3306: ancient but still being exploited. If FTP is still on anywhere, switch to SFTP.

No KEV hits this week for Proxmox, TrueNAS, UniFi, pfSense, Synology, or QNAP.

Disclosure: I put together a weekly digest of this. Not dropping a link, but happy to answer questions about any of these here.

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2026-104935 in Ivanti Connect Secure went public on October 13, and CISA added it to KEV the same day. Federal agencies have until October 16. Volexity found it while working an incident at a customer. The actor, which it tracks as UTA0576, started on October 3 against an appliance running 22.8R2.4, the fully patched build at the time.

The way in is welcome.cgi, the public login page. A request to it can carry a header naming a script that sits behind the login, and that script runs. A race in the wu.cgi upload handler turns that into code execution, and a third bug in the dsinvoked service gets root. Ivanti’s patch covers the first two (on the 22.8 line that’s 22.8R2.5, per SecurityWeek). The root escalation is still open.

Once in, the actor used the appliance’s own AD service account to search for LAPS passwords and BitLocker recovery keys. Volexity says Ivanti’s Integrity Checker Tool doesn’t detect it, because the exploit patches a library in memory and then puts it back. CISA wrote the same about that tool in February 2024, after the CVE-2023-46805 attacks.

Ivanti told CyberScoop it found a portion of this bug in internal checks in June, and that it “did not meet the threshold for an out-of-band release.” Rapid7 quotes Ivanti saying that portion was fixed in 25.1.3.0 in July. The exploitation started while the backport to the older lines was still in progress.

The WordPress version of that public page is wp-login.php, sitting at the same default path on every install.

CISA’s alert also says 22.8, the line Volexity saw hit, reaches end of life on January 31, 2027. If Ivanti knew about part of this bug in June and shipped the fix to one branch in July, who should get to decide that everyone on the other branches can wait for the normal release cycle?

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client.

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

This week’s list is a little Windows-heavy thanks to June Patch Tuesday. Four of the five are already on CISA’s KEV list, the DHCP flaw can be triggered from the local network, and Oracle had to release an out-of-band fix for a PeopleSoft zero-day that was already being used in attacks.

1. CVE-2026-44815: Windows DHCP Client

A malicious DHCP server on the same network can send a crafted response and get code execution on Windows clients. That makes this more important than a normal workstation patch, especially on guest Wi-Fi, branch networks, or anywhere you don’t fully trust the local segment.

Scope: Windows systems using DHCP Why now: Critical, KEV-listed, CISA deadline June 23 Next step: Deploy the June 2026 Windows updates

2. CVE-2026-35273: Oracle PeopleSoft PeopleTools

Unauthenticated RCE that attackers were already using for data theft before Oracle released the fix. Any exposed or affected PeopleSoft server deserves both a patch and a closer look at what happened before it was patched.

Scope: PeopleTools 8.61 and 8.62 Why now: CVSS 9.8, KEV-listed, CISA deadline July 3 Next step: Apply Oracle’s out-of-band update and check for signs of post-exploitation activity

3. CVE-2026-0257: Palo Alto PAN-OS GlobalProtect

An authentication bypass that allows attackers to establish GlobalProtect VPN sessions without valid credentials. Since this sits at the front door of the networks running a Palo fw, log review matters almost as much as installing the fix.

Scope: Exposed GlobalProtect portals and gateways Why now: Active exploitation confirmed by Unit 42 on June 9 Next step: Apply the appropriate PAN-OS hotfix and investigate any VPN sessions you can’t explain

4. CVE-2026-10520 / CVE-2026-10523: Ivanti Sentry

This is a rough pair: one flaw allows unauthenticated root RCE, while the other can be used to create a rogue administrator account. Either one would justify urgent work on its own.

Scope: Ivanti Sentry gateway deployments Why now: CVSS 10.0 and 9.9; both KEV-listed Next step: Upgrade to the fixed release in Ivanti’s advisory

5. CVE-2026-47288: Windows Kerberos KDC

Critical RCE in the Windows Kerberos Key Distribution Center, putting domain controllers in the blast radius. There is no confirmed exploitation listed here yet, but the affected role makes delaying it a hard sell.

Scope: Windows Server domain controllers Why now: Critical, released with June 2026 Patch Tuesday Next step: Roll out the June updates, with domain controllers handled early

I try to limit these posts to 5 CVE's so it doesn't get too long, but feel free to discuss anything that missed the cut down in the comments!