Ivanti Connect Secure Zero-Day Authentication Bypass CVE-2026-104935 Actively Exploited
On October 13, 2026, Ivanti disclosed a high‑severity authentication‑bypass zero‑day (CVE-2026-104935) affecting Ivanti Connect Secure VPN appliances. The flaw allows a remote, unauthenticated attacker to spoof authentication and execute arbitrary commands on the device. Active exploitation was observed by Volexity in early October, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog the same day. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patched versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Immediate out‑of‑cycle patching and IOC monitoring are required.
Cisco Catalyst SD-WAN Manager Authentication Bypass CVE-2026-76504
Cisco PSIRT has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager (vManage) affecting multiple release branches. The flaw arises from improper handling of URL-encoded characters within the j_security_check API endpoint, allowing unauthenticated remote attackers to bypass security controls using crafted requests, such as POST /%6a_security_check. Active exploitation has been confirmed in the wild, prompting immediate inclusion in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation grants full administrative control over the SD-WAN control plane, enabling lateral movement and potential compromise of the entire managed network infrastructure. Immediate patching is required as no software workarounds are available.