Ivanti Connect Secure Zero-Day Authentication Bypass CVE-2026-104935 Actively Exploited
On October 13, 2026, Ivanti disclosed a high‑severity authentication‑bypass zero‑day (CVE-2026-104935) affecting Ivanti Connect Secure VPN appliances. The flaw allows a remote, unauthenticated attacker to spoof authentication and execute arbitrary commands on the device. Active exploitation was observed by Volexity in early October, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog the same day. Affected releases include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patched versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Immediate out‑of‑cycle patching and IOC monitoring are required.
Ransomware Exploitation of Palo Alto Networks GlobalProtect CVE-2024-3400
CVE-2024-3400 is a critical command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateways. Unauthenticated attackers exploit the flaw by sending crafted HTTP requests containing shell metacharacters (e.g., ;, &, |) within the user or hostname parameters of the GlobalProtect portal. This enables arbitrary OS command execution, facilitating the deployment of ChinaChopper webshells and the UpStyle Python backdoor for persistent command-and-control (C2) communication via reverse TCP tunnels. Weaponized by ransomware affiliates—including LockBit 3.0 and Clop—the exploit chain is used to harvest credentials and encrypt critical systems, resulting in significant impact across healthcare, government, and financial sectors.