{"metadata": {"vulnerability": "CVE-2026-104935", "count": 163, "kinds": {"milestone": 9, "sighting": 122, "kev": 15, "other": 17}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0416", "record": "NCSC-2026-0416", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-02T17:07:30.656Z", "date_only": false, "value": "2026-10-02T17:07:30.656Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104935", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-09T08:39:03Z", "date_only": false, "value": "2026-10-09T08:39:03+00:00", "kind": "kev", "label": "Asserted", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-104935", "field": "timestamps.asserted_at", "uuid": "79a2314a-22aa-4340-aed4-c7496bdd0652", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T08:39:03Z", "date_only": false, "value": "2026-10-09T08:39:03+00:00", "kind": "kev", "label": "First seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-104935", "field": "timestamps.first_seen_at", "uuid": "79a2314a-22aa-4340-aed4-c7496bdd0652", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T08:39:03Z", "date_only": false, "value": "2026-10-09T08:39:03+00:00", "kind": "kev", "label": "Last seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-104935", "field": "timestamps.last_seen_at", "uuid": "79a2314a-22aa-4340-aed4-c7496bdd0652", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T08:39:03Z", "date_only": false, "value": "2026-10-09T08:39:03+00:00", "kind": "kev", "label": "Status updated", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-104935", "field": "status.status_updated_at", "uuid": "79a2314a-22aa-4340-aed4-c7496bdd0652", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T08:41:31.325Z", "date_only": false, "value": "2026-10-09T08:41:31.325478Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/79a2314a-22aa-4340-aed4-c7496bdd0652", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "93ca050a-3a76-4117-a099-1df610e05665", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/79a2314a-22aa-4340-aed4-c7496bdd0652"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "timestamps.asserted_at", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104935", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "evidence.0.details.date_added", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "timestamps.first_seen_at", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-013", "record": "CERTFR-2026-ALE-013", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1311", "record": "CERTFR-2026-AVI-1311", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "status.status_updated_at", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104935", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-13T09:22:36Z", "date_only": false, "value": "2026-10-13T09:22:36.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/zero-day-kwetsbaarheid-in-ivanti-connect-secure-update-direct", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "40d89c25-222c-482e-a4af-1975b355d36d", "url": "https://www.ncsc.nl/alerts/zero-day-kwetsbaarheid-in-ivanti-connect-secure-update-direct"}, {"timestamp": "2026-10-13T11:37:18Z", "date_only": false, "value": "2026-10-13T11:37:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-35", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "5452c574-6dc0-4e97-ae51-a0c53d471613", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-35"}, {"timestamp": "2026-10-13T12:32:43Z", "date_only": false, "value": "2026-10-13T12:32:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "04554dd5-8b5d-4f7f-a5d7-bbe37f1498af", "url": "https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035"}, {"timestamp": "2026-10-13T14:36:03.187Z", "date_only": false, "value": "2026-10-13T14:36:03.187839Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117434097562080187", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "f1edad7f-f8cc-4b6e-9bf9-64bb2239d2a8", "content": "Ivanti Connect Secure zero-day CVE-2026-104935\n\nWe are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure. \nhttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US\n#ivanti #ics #zeroday #eitw #cve", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117434097562080187"}, {"timestamp": "2026-10-13T14:39:04.024Z", "date_only": false, "value": "2026-10-13T14:39:04.024036Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117434111492225780", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "96da1031-430e-42c5-9890-9c9a62104d62", "content": "Ivanti Secure Connect has an in the wild zero day allowed unauth RCE, patch is out\nhttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US\nCVE-2026-104935", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117434111492225780"}, {"timestamp": "2026-10-13T14:46:42.363Z", "date_only": false, "value": "2026-10-13T14:46:42.363351Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxrbkz5yrc2t", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "c6276b60-8aee-4b3e-9ffb-21fa34998511", "content": "Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now.\n\n#Ivanti #ConnectSecure #CVE2026104935 #ExploitedInTheWild #VPNSecurity #ZeroDay #PatchNow #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxrbkz5yrc2t"}, {"timestamp": "2026-10-13T14:50:20.296Z", "date_only": false, "value": "2026-10-13T14:50:20.296563Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techupscale.com/post/3mxrbridzv32t", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a58eb237-004f-45c5-8303-af7db214d83d", "content": "\ud83d\udea8 BREAKING: Ivanti Connect Secure flaw CVE-2026-104935 is being actively exploited, CISA warns\n\nCVE-2026-104935  \u00b7  US federal deadline October 16, 2026  \u00b7  CISA KEV\n\n#cybersecurity #vulnerability", "url": "https://bsky.app/profile/techupscale.com/post/3mxrbridzv32t"}, {"timestamp": "2026-10-13T14:50:46Z", "date_only": false, "value": "2026-10-13T14:50:46+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-104935", "field": "timestamps.asserted_at", "uuid": "daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T14:50:46Z", "date_only": false, "value": "2026-10-13T14:50:46+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-104935", "field": "timestamps.first_seen_at", "uuid": "daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T14:50:46Z", "date_only": false, "value": "2026-10-13T14:50:46+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-104935", "field": "status.status_updated_at", "uuid": "daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T14:50:46.747Z", "date_only": false, "value": "2026-10-13T14:50:46.747Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-104935", "field": "evidence.0.details.added_date", "uuid": "daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T14:57:25.484Z", "date_only": false, "value": "2026-10-13T14:57:25.484961Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrc66tcyo2x", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "fa93be67-8f24-4478-835e-637360e812dd", "content": "\ud83d\uded1 CVE-2026-104935\nIvanti Connect Secure\nKEV \u2705\nTL;DR: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote una\u2026\nhttps://cvesentinel.com/report/CVE-2026-104935?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrc66tcyo2x"}, {"timestamp": "2026-10-13T15:00:01Z", "date_only": false, "value": "2026-10-13T15:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "timestamps.recorded_at", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T15:00:02.910Z", "date_only": false, "value": "2026-10-13T15:00:02.910878Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1de65794-4de9-442e-9a39-299bf381cadf", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "062ba9ed-4acd-4e49-ab4a-d101b1207b73", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1de65794-4de9-442e-9a39-299bf381cadf"}, {"timestamp": "2026-10-13T15:00:43.680Z", "date_only": false, "value": "2026-10-13T15:00:43.680739Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0416", "record": "NCSC-2026-0416", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T15:00:43.680Z", "date_only": false, "value": "2026-10-13T15:00:43.680739Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0416", "record": "NCSC-2026-0416", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T15:00:43.680Z", "date_only": false, "value": "2026-10-13T15:00:43.680739Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0416", "record": "NCSC-2026-0416", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T15:07:49.600Z", "date_only": false, "value": "2026-10-13T15:07:49.600007Z", "kind": "sighting", "label": "Seen", "source": "https://social.circl.lu/users/circl/statuses/117434225046743984", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "c2777757-9753-463e-a7da-c4685dde061f", "content": "Security Advisory Ivanti Connect Secure (CVE-2026-104935)\n#ivanti #cybersecurity #cve #vulnerabilitymanagement #vuln \n\ud83d\udd17 https://vulnerability.circl.lu/vuln/CVE-2026-104935#sightings\n\ud83d\udd17  https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US", "url": "https://social.circl.lu/users/circl/statuses/117434225046743984"}, {"timestamp": "2026-10-13T15:20:03.490Z", "date_only": false, "value": "2026-10-13T15:20:03.490718Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxrdgmxmdy2b", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a76e5b46-161c-4f10-b853-d280e8b229e0", "content": "CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities list (2026-10-13).\nIvanti Connect Secure Authentication Bypass by Spoofing\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxrdgmxmdy2b"}, {"timestamp": "2026-10-13T15:30:57.470Z", "date_only": false, "value": "2026-10-13T15:30:57.470733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxre24yc632o", "record": "cve-2026-104935", "field": "creation_timestamp", "uuid": "3f7348df-dddb-40e9-be38-aca0f8afeee0", "content": "CISA just added CVE-2026-104935 to the KEV list per primary catalog entry.\nIvanti Connect Secure flaw lets remote attackers run commands without auth.\nPatch deadline: October 16.\n\nhttps://thecircuitry.to/article/cisa-adds-ivanti-connect-secure-cve-2026-104935-to-kev-catalog-mv6thu3w", "url": "https://bsky.app/profile/thecircuitry.to/post/3mxre24yc632o"}, {"timestamp": "2026-10-13T15:31:07.757Z", "date_only": false, "value": "2026-10-13T15:31:07.757Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104935", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T15:31:07.757Z", "date_only": false, "value": "2026-10-13T15:31:07.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ivanti", "record": "CVE-2026-104935", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T15:40:14.640Z", "date_only": false, "value": "2026-10-13T15:40:14.640619Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117434352531594117", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "bd80bb0d-9e4c-4dc1-8019-5d18646af5c5", "content": "CVE-2026-104935  Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104935https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935#Ivanti #ConnectSecure#CVE_2026_104935#bot", "url": "https://infosec.exchange/users/cve/statuses/117434352531594117"}, {"timestamp": "2026-10-13T15:42:16.582Z", "date_only": false, "value": "2026-10-13T15:42:16.582526Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104935", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T15:42:16.582Z", "date_only": false, "value": "2026-10-13T15:42:16.582526Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104935", "record": "FKIE_CVE-2026-104935", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T15:47:58.303Z", "date_only": false, "value": "2026-10-13T15:47:58.303595Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/volexity/statuses/117434382904904354", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "5653af12-c00f-4891-bb07-fb90f3d7af71", "content": "@volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti\u2019s Integrity Checker Tool.\nUsing its #Volcano memory analysis platform, Volexity analyzed the compromised device\u2019s memory to uncover the full exploit chain and the attacker\u2019s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure. \nRead the full analysis, including detection guidance and IOCs, in our blog post here: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/\n#DFIR #threatintel #memoryforensics", "url": "https://infosec.exchange/users/volexity/statuses/117434382904904354"}, {"timestamp": "2026-10-13T15:50:25.802Z", "date_only": false, "value": "2026-10-13T15:50:25.802125Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/volexity.com/post/3mxrf4vw6f224", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "4e3d5e62-f433-4d5e-86c9-5d4b3ece6155", "content": "Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.\u2028\u2028\n#DFIR #threatintel", "url": "https://bsky.app/profile/volexity.com/post/3mxrf4vw6f224"}, {"timestamp": "2026-10-13T15:50:26.249Z", "date_only": false, "value": "2026-10-13T15:50:26.249295Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/volexity.com/post/3mxrf4wt64k24", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "d1d98ee3-8024-44e8-b65f-d1f791ae0527", "content": "Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.\u2028\u2028\n#DFIR #threatintel", "url": "https://bsky.app/profile/volexity.com/post/3mxrf4wt64k24"}, {"timestamp": "2026-10-13T15:50:26.695Z", "date_only": false, "value": "2026-10-13T15:50:26.695368Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/volexity.com/post/3mxrf4wt73s24", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "da8502d1-b656-42e5-b3c9-23fa6698e067", "content": "Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.\u2028\u2028\n#DFIR #threatintel", "url": "https://bsky.app/profile/volexity.com/post/3mxrf4wt73s24"}, {"timestamp": "2026-10-13T15:57:49.849Z", "date_only": false, "value": "2026-10-13T15:57:49.849539Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrfk6zitg2j", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "5a8266d3-5c56-4209-867d-998318382eeb", "content": "\ud83d\uded1 CVE-2026-104935\nIvanti Connect Secure\nKEV \u2705\nTL;DR: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote una\u2026\nhttps://cvesentinel.com/report/CVE-2026-104935?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxrfk6zitg2j"}, {"timestamp": "2026-10-13T16:02:45.917Z", "date_only": false, "value": "2026-10-13T16:02:45.917358Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117434413364945714", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "f3bf501a-93fa-4bbb-87c1-49fea6d7d37f", "content": "Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory (CVE-2026-104935) providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.\nhttps://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/\n#ivanti #volexity #ivanticonnectsecure #zeroday #kev #eitw #cve", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117434413364945714"}, {"timestamp": "2026-10-13T16:03:49.213Z", "date_only": false, "value": "2026-10-13T16:03:49.213273Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117434144073318279", "record": "cve-2026-104935", "field": "creation_timestamp", "uuid": "775fad57-0a59-4aec-a330-5e050984e414", "content": "Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now.\n#Ivanti #ConnectSecure #CVE2026104935 #ExploitedInTheWild #VPNSecurity #ZeroDay #PatchNow #CyberSecurity\nhttps://securityonline.info/ivanti-connect-secure-cve-2026-104935-exploited/?utm_source=mastodon&utm_medium=jetpack_social", "url": "https://infosec.exchange/ap/users/116797276219291526/statuses/117434144073318279"}, {"timestamp": "2026-10-13T16:06:23.921Z", "date_only": false, "value": "2026-10-13T16:06:23.921171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mxrfzissgs22", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "051c82e6-2adc-461d-b948-a9edac3f93bd", "content": "Ivanti warns of an exploited Connect Secure zero-day, CVE-2026-104935, an auth bypass allowing remote command execution, per BleepingComputer. Volexity reported it; patches are out. CISA added it to KEV. bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mxrfzissgs22"}, {"timestamp": "2026-10-13T16:10:11.179Z", "date_only": false, "value": "2026-10-13T16:10:11.179059Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxrgabfczj2y", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "2836c5ee-8dd9-4785-8e15-e3d07100e568", "content": "@volexity.com\nUTA0576 chained zero-days for unauthenticated root RCE, credential theft and reconnaissance.\n-\nIOCs: 108[.]165[.]147[.]64, CVE-2026-104935\n-\n#CVE2026104935 #Ivanti #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxrgabfczj2y"}, {"timestamp": "2026-10-13T16:16:04.701Z", "date_only": false, "value": "2026-10-13T16:16:04.701657Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117434492812846886", "record": "cve-2026-104935", "field": "creation_timestamp", "uuid": "ddce2aeb-042e-4a8e-85ce-49e9e04bd6a9", "content": "An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity.\nhttps://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900\n#ThreatIntel #ThreatIntelligence #IFIN", "url": "https://infosec.exchange/ap/users/115741367687413652/statuses/117434492812846886"}, {"timestamp": "2026-10-13T16:17:11Z", "date_only": false, "value": "2026-10-13T16:17:11Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VM2G-WHWH-XHQ8", "record": "GHSA-VM2G-WHWH-XHQ8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-13T16:17:11.640Z", "date_only": false, "value": "2026-10-13T16:17:11.640", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104935", "record": "FKIE_CVE-2026-104935", "field": "published"}, {"timestamp": "2026-10-13T16:18:41.344Z", "date_only": false, "value": "2026-10-13T16:18:41.344026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxrgpiiibr2t", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "30da1fbe-b72c-4501-b024-3b188f3f693a", "content": "\ud83e\udd16 CVE-2026-104935: auth-bypass 0-day in Ivanti Connect Secure, exploited in the wild. Unauthenticated attackers can run commands on exposed appliances. Patch now.\nhttps://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxrgpiiibr2t"}, {"timestamp": "2026-10-13T16:20:12.056Z", "date_only": false, "value": "2026-10-13T16:20:12.056171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxrgs6qr7b2p", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "cfd63ac4-2a3b-4f8e-90aa-0861cb5cf087", "content": "UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.\n\n#Ivanti #ZeroDay #CVE2026104935 #UTA0576 #Volexity #VPN #ActiveDirectory #Cybersecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxrgs6qr7b2p"}, {"timestamp": "2026-10-13T16:28:09.681Z", "date_only": false, "value": "2026-10-13T16:28:09.681173Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/117434540875291969", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "98b47862-1fed-4e58-9c6d-e5db04b97e63", "content": "@GossiTheDog @volexity \nVolexity: \n\nThis exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.\nIvanti: \n\n\"This\" is CVE-2026-104935", "url": "https://infosec.exchange/users/wdormann/statuses/117434540875291969"}, {"timestamp": "2026-10-13T16:29:19.809Z", "date_only": false, "value": "2026-10-13T16:29:19.809605Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrhcjoczs26", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "3740378c-0e3d-4d6c-9064-c94c648ba0af", "content": "Ivanti Connect Secure auth-bypass zero-day CVE-2026-104935 is being actively exploited and is now on CISA KEV, deadline 16 Oct. No fixed build confirmed yet \u2014 run the Integrity Checker Tool now. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxrhcjoczs26"}, {"timestamp": "2026-10-13T16:36:01.990Z", "date_only": false, "value": "2026-10-13T16:36:01.990980Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117434571898086341", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "e1b59f7a-ff4f-4ad4-8c6e-265b52a5a0b6", "content": "Ivanti warns of Connect Secure zero-day exploited in attacks\nIvanti has urged customers to immediately patch an actively exploited zero-day in the Ivanti Connect Secure remote access gateway, BleepingComputer reports. CVE-2026-104935 is a high-severity authentication bypass affecting ICS versions 22.8R2.4 and earlier that lets unauthenticated attackers execute arbitrary commands on targeted appliances. https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/", "url": "https://infosec.exchange/users/edwardk/statuses/117434571898086341"}, {"timestamp": "2026-10-13T16:40:02.047Z", "date_only": false, "value": "2026-10-13T16:40:02.047451Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxrhvnx7xm2i", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "5db716cf-7fa9-4126-a086-23e9278cb50c", "content": "CISA added CVE-2026-104935 to its known exploited list this afternoon. For those managing Ivanti Connect Secure gateways, the clock is now ticking toward a federal patch deadline of October 16.\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxrhvnx7xm2i"}, {"timestamp": "2026-10-13T17:00:16.236Z", "date_only": false, "value": "2026-10-13T17:00:16.236643Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mxriztrb572i", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "0327882b-ad30-4615-8619-421592cc813c", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1013)\n\n\u26a0\ufe0f CVE-2026-104935 - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mxriztrb572i"}, {"timestamp": "2026-10-13T17:02:12.649Z", "date_only": false, "value": "2026-10-13T17:02:12.649255Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117434674847758427", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "62a9d39d-e247-42c1-b7b6-897a99dc4c49", "content": "New.\nCISA has added the latest Ivanti flaw to the catalogue.\n- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-104935 #infosec #vulnerability #CISA #Ivanti", "url": "https://infosec.exchange/users/AAKL/statuses/117434674847758427"}, {"timestamp": "2026-10-13T17:08:51.338Z", "date_only": false, "value": "2026-10-13T17:08:51.338661Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxrjj6qrij2x", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9f9dd780-9c38-476a-a028-7dacdb1a1c42", "content": "Ivanti's Partial Patch Leaves Third Flaw Open in Zero-Day CVE-2026-104935", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mxrjj6qrij2x"}, {"timestamp": "2026-10-13T18:00:00Z", "date_only": false, "value": "2026-10-13T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/ivanti-connect-secure-remote-code-execution-vulnerability_20261014", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "c3720e05-317d-40f8-816c-6fa372568da9", "url": "https://www.hkcert.org/security-bulletin/ivanti-connect-secure-remote-code-execution-vulnerability_20261014"}, {"timestamp": "2026-10-13T18:00:13.533Z", "date_only": false, "value": "2026-10-13T18:00:13.533928Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mxrmezgeab2q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b1846567-73e2-473e-9daf-355745cae2c8", "content": "UK/DE M365 outage: GSA hits Outlook, Teams, OneDrive. Office 2021 support ends; Publisher removed. Patch exploited Ivanti CVE-2026-104935. Photos PC backup now web-only. UCS-to-AD migration discussion. +26 more stories", "url": "https://bsky.app/profile/windowsforum.com/post/3mxrmezgeab2q"}, {"timestamp": "2026-10-13T18:15:04.103Z", "date_only": false, "value": "2026-10-13T18:15:04.103403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxrn7lpavb2s", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a44658b3-bfb1-46dd-8204-65d5e1a4c77d", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nIvanti Connect Secure: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability\nCVE-2026-104935 \u00b7 patch by 2026-10-16\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-104935\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxrn7lpavb2s"}, {"timestamp": "2026-10-13T18:15:53.919Z", "date_only": false, "value": "2026-10-13T18:15:53.919346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2u5qc2h", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "7f8e47a5-f4fc-41ba-89cb-2e7bb1d7922c", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-97229 \u00b7 29 people\n2. CVE-2026-104935 \u00b7 15 people \ud83d\udd25\n3. CVE-2026-105445 \u00b7 7 people\n4. CVE-2026-102255 \u00b7 6 people\n5. CVE-2026-85097 \u00b7 6 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2u5qc2h"}, {"timestamp": "2026-10-13T18:15:54.913Z", "date_only": false, "value": "2026-10-13T18:15:54.913282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2xl4c2h", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "db8d60b3-de30-47a6-86df-29f833271458", "content": "2. CVE-2026-104935 \u00b7 15 people \ud83d\udd25\n\ud83d\udfe7 High 8.6 \u00b7 Ivanti Connect Secure\n\nAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxrnb2xl4c2h"}, {"timestamp": "2026-10-13T18:23:50.737Z", "date_only": false, "value": "2026-10-13T18:23:50.737963Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-e8f8475b-3b94ee87ce9cb080", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "87489fb0-8580-46d1-b199-a07406e91738", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is an authentication bypass issue caused by [\u2026]U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-e8f8475b-3b94ee87ce9cb080"}, {"timestamp": "2026-10-13T18:24:32.902Z", "date_only": false, "value": "2026-10-13T18:24:32.902983Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxrnpajmtye2", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "ab38f8c5-f858-4175-8519-82b79ed499e8", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8 [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mxrnpajmtye2"}, {"timestamp": "2026-10-13T18:30:49Z", "date_only": false, "value": "2026-10-13T18:30:49Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VM2G-WHWH-XHQ8", "record": "GHSA-VM2G-WHWH-XHQ8", "field": "published"}, {"timestamp": "2026-10-13T18:30:49Z", "date_only": false, "value": "2026-10-13T18:30:49Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VM2G-WHWH-XHQ8", "record": "GHSA-VM2G-WHWH-XHQ8", "field": "modified"}, {"timestamp": "2026-10-13T19:19:24.862Z", "date_only": false, "value": "2026-10-13T19:19:24.862933Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mxrqsn7uhc2v", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a2d9a9d8-9fad-4ace-8c33-f267a711fac7", "content": "Ivanti disclosed a zero-day vulnerability (CVE-2026-104935) in Ivanti Connect Secure, allowing remote attackers to execute arbitrary commands without authentication. The flaw, with a CVSS score of 8.6, affects versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mxrqsn7uhc2v"}, {"timestamp": "2026-10-13T19:24:36.243Z", "date_only": false, "value": "2026-10-13T19:24:36.243", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104935", "record": "FKIE_CVE-2026-104935", "field": "lastModified"}, {"timestamp": "2026-10-13T19:26:21.811Z", "date_only": false, "value": "2026-10-13T19:26:21.811786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sipirtu.com/post/3mxrr72rasx2n", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a72a4b59-0669-4169-8a3d-18fc37ad16ca", "content": "A zero-day vulnerability identified as CVE-2026-104935 affects Ivanti Connect Secure and can be exploited for unauthenticated remote code execution with elevated privileges.\n\nSource: SecurityWeek", "url": "https://bsky.app/profile/sipirtu.com/post/3mxrr72rasx2n"}, {"timestamp": "2026-10-13T19:48:26.558Z", "date_only": false, "value": "2026-10-13T19:48:26.558521Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxrsgktsk72f", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "0091e45e-2a53-42c0-9b06-cf7ac5fdf054", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitra\u2026\nCVSS 8.6 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-104935\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxrsgktsk72f"}, {"timestamp": "2026-10-13T19:58:23.946Z", "date_only": false, "value": "2026-10-13T19:58:23.946Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104935", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:58:23.946Z", "date_only": false, "value": "2026-10-13T19:58:23.946Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104935", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:04:04.274Z", "date_only": false, "value": "2026-10-13T20:04:04.274062Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117435389161785482", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "c2cf84b1-2dac-45d2-9864-7a7eeee00324", "content": "Placeholder CISA blog post about Ivanti Connect Secure zero-day CVE-2026-104935 and Microsoft Windows Shell Security Feature Bypass zero-day CVE-2026-96951\nhttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog\n#CISA #KEV #eitw #zeroday #PatchTuesday", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117435389161785482"}, {"timestamp": "2026-10-13T20:49:06.942Z", "date_only": false, "value": "2026-10-13T20:49:06.942734Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxrvt2dyft2e", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "bb43779f-63e5-460b-a547-f7ad0adacf49", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitra\u2026\nCVSS 8.6 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-104935\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxrvt2dyft2e"}, {"timestamp": "2026-10-13T21:00:00Z", "date_only": false, "value": "2026-10-13T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2107", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b251a476-1c5b-414a-98fa-c5b7ab81c708", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2107"}, {"timestamp": "2026-10-13T21:47:30.700Z", "date_only": false, "value": "2026-10-13T21:47:30.700341Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mxrz3eshxs2o", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "fcc01d3b-a9a1-4357-9f49-acfbffdcde71", "content": "Security Advisory Ivanti Connect Secure (CVE-2026-104935)\nhub.ivanti.com/s/article/Se...", "url": "https://bsky.app/profile/samilaiho.com/post/3mxrz3eshxs2o"}, {"timestamp": "2026-10-13T23:06:21.686Z", "date_only": false, "value": "2026-10-13T23:06:21.686073Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mxs5igxatm2x", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9ada3adc-1955-4367-ac93-7258e9b11b4b", "content": "Attackers are exploiting a zero-day in Ivanti Connect Secure VPN to gain root access and steal sensitive data; patches for two flaws exist, one is pending.\n\nCVE-2026-104935 #ZeroDay #Flaw #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mxs5igxatm2x"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-013", "record": "CERTFR-2026-ALE-013", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1311", "record": "CERTFR-2026-AVI-1311", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-013", "record": "CERTFR-2026-ALE-013", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1311", "record": "CERTFR-2026-AVI-1311", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-013", "record": "CERTFR-2026-ALE-013", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1311", "record": "CERTFR-2026-AVI-1311", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:40:20Z", "date_only": false, "value": "2026-10-14T00:40:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-14/Ivanti-nuldagssaarbarheder-gav-root-adgang-til-opdaterede-VPN-gateways", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "941d97e8-d01e-4850-88a2-042278e72d93", "url": "https://www.cert.dk/news/2026-10-14/Ivanti-nuldagssaarbarheder-gav-root-adgang-til-opdaterede-VPN-gateways"}, {"timestamp": "2026-10-14T00:57:34Z", "date_only": false, "value": "2026-10-14T00:57:34.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-104935.yaml", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "132a4dd9-5434-4fcf-9511-327f7f2515ca", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-104935.yaml"}, {"timestamp": "2026-10-14T00:59:22.937Z", "date_only": false, "value": "2026-10-14T00:59:22.937027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yogsec.bsky.social/post/3mxsdskky3s2m", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "cb10b5cb-e33a-42ae-8c39-3b02d056ad1b", "content": "U.S. cybersecurity officials have added a critical Ivanti Connect Secure vulnerability (CVE-2026-104935) to the Known Exploited Vulnerabilities catalog.\n\nRead more: cybernoz.com/u-s-cisa-add...\n\n#Ivanti #ZeroDay #CISA #CyberSecurity", "url": "https://bsky.app/profile/yogsec.bsky.social/post/3mxsdskky3s2m"}, {"timestamp": "2026-10-14T01:43:48.857Z", "date_only": false, "value": "2026-10-14T01:43:48.857483Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mxsgbys5fk2f", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "7d941008-2d80-497f-9f07-a9b86387204f", "content": "Security Patch now! Hackers already targeting newly disclosed Ivanti Connect Secure zero-day CVE-2026-104935 i\u2026\n\nwww.cyberdaily.au/security/142...\n\n#Cybersecurity #LargeScaleImpact #Vulnerability", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mxsgbys5fk2f"}, {"timestamp": "2026-10-14T02:07:06.488Z", "date_only": false, "value": "2026-10-14T02:07:06.488018Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mxshloeifw2q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "4dee2efb-4bd2-4cc2-a322-ccc0ff60a903", "content": "\ud83d\udccc CVE-2026-104935 - Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not... https://www.cyberhub.blog/cves/CVE-2026-104935", "url": "https://bsky.app/profile/cyberhub.blog/post/3mxshloeifw2q"}, {"timestamp": "2026-10-14T02:18:43.328Z", "date_only": false, "value": "2026-10-14T02:18:43.328738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/zubiqo.bsky.social/post/3mxsiagb3e32w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "5388ccdd-8690-4601-9ea7-6bf0afae0260", "content": "Ivanti's Connect Secure VPN has another actively exploited zero-day (CVE-2026-104935, 8.6 CVSS) that a watchTowr researcher says bypasses authentication via a single crafted \"X-DSCGI-PATH\" header.\n\nPerimeter security boxes keep handing root access to anyone who can spoof an HTTP header.", "url": "https://bsky.app/profile/zubiqo.bsky.social/post/3mxsiagb3e32w"}, {"timestamp": "2026-10-14T02:32:21.487Z", "date_only": false, "value": "2026-10-14T02:32:21.487893Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsiysrdk22p", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "765e82e1-110d-43f0-9bb9-d0d896cc5a4f", "content": "\ud83e\udd16 Ivanti Connect Secure: chained zero-days (auth bypass + RCE = CVE-2026-104935, plus an unpatched privesc) exploited in the wild for unauthenticated root RCE. Ivanti: act immediately.\nhttps://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxsiysrdk22p"}, {"timestamp": "2026-10-14T03:19:21Z", "date_only": false, "value": "2026-10-14T03:19:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/ivanti-october-security-update-1", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "1aec134c-e3f2-4562-9cb8-348dc0791ae6", "url": "https://www.acn.gov.it/portale/w/ivanti-october-security-update-1"}, {"timestamp": "2026-10-14T04:01:31.508Z", "date_only": false, "value": "2026-10-14T04:01:31.508112Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxsnybar7z2y", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "8fd4ff9c-4953-4b7d-9f29-949f7ab89f62", "content": "~Cisa~\nCISA urges immediate patching after unauthenticated exploitation enabled credential theft and data exfiltration.\n-\nIOCs: CVE-2026-104935\n-\n#CVE-2026-104935 #Ivanti #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mxsnybar7z2y"}, {"timestamp": "2026-10-14T04:30:17Z", "date_only": false, "value": "2026-10-14T04:30:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerability-ivanti-connect-secure-allows-remote", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "da309a56-9e0d-4bcb-81d5-9a47fb4896ac", "url": "https://ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerability-ivanti-connect-secure-allows-remote"}, {"timestamp": "2026-10-14T04:58:10.753Z", "date_only": false, "value": "2026-10-14T04:58:10.753931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsr5ky7hu25", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "cf890cbd-9af2-4a98-970b-cda55c08286c", "content": "\u30cf\u30c3\u30ab\u30fc\u304cIvanti Connect Secure\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u60aa\u7528\u3001\u8a8d\u8a3c\u306a\u3057\u3067root\u6a29\u9650\u3092\u596a\u53d6\n\nIvanti\u306f\u3001Ivanti Connect Secure\uff08ICS\uff09\u3067\u898b\u3064\u304b\u3063\u305f\u91cd\u5927\u5ea6\u306e\u9ad8\u3044\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300cCVE-2026-104935\u300d\u3092\u4fee\u6b63\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u540c\u793e\u306f\u3001\u3053\u306e\u8106\u5f31\u6027\u304c\u4e00\u90e8\u306e\u9867\u5ba2\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u305f\u3053\u3068\u3092\u78ba\u8a8d\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30ea\u30e2\u30fc\u30c8\u306e\u653b\u6483", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxsr5ky7hu25"}, {"timestamp": "2026-10-14T06:34:23.737Z", "date_only": false, "value": "2026-10-14T06:34:23.737534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjm6dsb2s", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "53f9d879-2771-4608-94b7-32f83390a844", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 13/10) \u00b7 2\n\u2022 Ivanti Connect Secure CVE-2026-104935, CVSS 8.6\n\u2022 Microsoft Windows CVE-2026-96951, CVSS 8.8", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxswjm6dsb2s"}, {"timestamp": "2026-10-14T06:39:37.399Z", "date_only": false, "value": "2026-10-14T06:39:37.399346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxswsxnicu25", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "aac49cf0-e89d-46c0-9666-68889732ede6", "content": "Top 3 CVE for last 7 days:\nCVE-2026-21589: 50 interactions\nCVE-2026-97229: 28 interactions\nCVE-2026-104935: 26 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-104935: 26 interactions\nCVE-2026-97229: 14 interactions\nCVE-2026-105445: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxswsxnicu25"}, {"timestamp": "2026-10-14T06:40:45.878Z", "date_only": false, "value": "2026-10-14T06:40:45.878868Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxswuyy53t22", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a4e46e55-4d8b-471c-bd09-ff6b184dd548", "content": "Discover how a critical Ivanti Connect Secure vulnerability (CVE-2026-104935) is chained in zero-day attacks to gain root access and steal network secrets.\n\n#Ivanti #ConnectSecure #Cybersecurity #ZeroDay #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxswuyy53t22"}, {"timestamp": "2026-10-14T07:27:43.417Z", "date_only": false, "value": "2026-10-14T07:27:43.417585Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/youranonirc.bsky.social/post/3mxszixxvg324", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "e88c3ffa-ff39-46c8-9f48-92a924dc88d0", "content": "URGENT: Ivanti VPN zero-day (CVE-2026-104935) exploited for root access (Oct 13-14). Russia targets Ukraine energy despite ceasefire. Houthi attacks escalate in Saudi. Meta data breach via GitHub (Oct 13). #Cybersecurity #Anonymous #News", "url": "https://bsky.app/profile/youranonirc.bsky.social/post/3mxszixxvg324"}, {"timestamp": "2026-10-14T07:27:51.460Z", "date_only": false, "value": "2026-10-14T07:27:51.460469Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxszj7q5a22q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "3bc5913d-78c5-49d1-a7b1-e77bc12e7427", "content": "[1/2] Ivanti Connect Secure: 3 zero-day in catena (UTA0576, dal 3/10) \u2192 root unauth su appliance patchate. CVE-2026-104935 (auth bypass + RCE) patchata; la privesc no, fix tra settimane. #infosec", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxszj7q5a22q"}, {"timestamp": "2026-10-14T07:27:51.891Z", "date_only": false, "value": "2026-10-14T07:27:51.891282Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxszj7qprs2q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "725ced12-09f2-47d1-8ee3-bc39ab98aa44", "content": "[1/2] Ivanti Connect Secure: 3 zero-day in catena (UTA0576, dal 3/10) \u2192 root unauth su appliance patchate. CVE-2026-104935 (auth bypass + RCE) patchata; la privesc no, fix tra settimane. #infosec", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mxszj7qprs2q"}, {"timestamp": "2026-10-14T07:39:30.561Z", "date_only": false, "value": "2026-10-14T07:39:30.561633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mxt24m3hg26c", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "1a35ef76-0216-4076-9bf8-5b24608b0f81", "content": "Ivanti\u306e\u30bc\u30ed\u30c7\u30a4\u30c1\u30a7\u30fc\u30f3\u3092\u653b\u6483\u8005\u304c\u60aa\u7528\u3001root\u30a2\u30af\u30bb\u30b9\u3092\u53d6\u5f97\uff1aCVE-2026-104935 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/48078/", "url": "https://bsky.app/profile/shiojiri.com/post/3mxt24m3hg26c"}, {"timestamp": "2026-10-14T08:27:09.964Z", "date_only": false, "value": "2026-10-14T08:27:09.964046Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mxt4t5noi22a", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "ae1bd6c3-d896-4e98-a5b8-a8cc40bb4d39", "content": "\u26a0\ufe0f Ivanti Connect Secure zero-day CVE-2026-104935 (CVSS 8.6) is exploited in the wild: unauthenticated attackers can run commands on the gateway. NCSC-NL rates it high. Patch now and check for compromise.\n\nfingerprints.service.product=\"Ivanti Connect Secure\"\n\n#ModatMagnify", "url": "https://bsky.app/profile/modat-io.bsky.social/post/3mxt4t5noi22a"}, {"timestamp": "2026-10-14T11:36:21.982Z", "date_only": false, "value": "2026-10-14T11:36:21.982866Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxthflcajg2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "7b1c2c82-d1a0-4a43-8d85-a4622141193d", "content": "Ivanti says CVE-2026-104935, an unauthenticated command-execution flaw in Connect Secure, was exploited before disclosure. Updates are available for affected versions; organizations should patch urgently and check for compromise.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxthflcajg2w"}, {"timestamp": "2026-10-14T12:52:23.549Z", "date_only": false, "value": "2026-10-14T12:52:23.549241Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxtlnjfvyw27", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "6a7d1919-d168-4b8c-852a-fe0061fa3d7c", "content": "CISA urges immediate updates of Ivanti Connect Secure appliances after a zero-day authentication bypass (CVE-2026-104935) is actively exploited for command execution, credential theft, and data exfiltration.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxtlnjfvyw27"}, {"timestamp": "2026-10-14T12:55:34.423Z", "date_only": false, "value": "2026-10-14T12:55:34.423437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxtlt7awpd26", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a0aeb807-e68e-4559-be35-1990693aa96c", "content": "CISA urges immediate updates of Ivanti Connect Secure appliances after a zero-day authentication bypass (CVE-2026-104935) is actively exploited for command execution, credential theft, and data exfiltration.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxtlt7awpd26"}, {"timestamp": "2026-10-14T12:55:57.890Z", "date_only": false, "value": "2026-10-14T12:55:57.890992Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mxtltvkpht2u", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "cec38e1a-90db-4782-a7eb-80d21eff62c5", "content": "CISA urges immediate updates of Ivanti Connect Secure appliances after a zero-day authentication bypass (CVE-2026-104935) is actively exploited for command execution, credential theft, and data exfiltration.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mxtltvkpht2u"}, {"timestamp": "2026-10-14T13:04:25.079Z", "date_only": false, "value": "2026-10-14T13:04:25.079440Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mxtmczxelm2v", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a9297700-a609-40fc-a70a-bb703deeb97c", "content": "CISA urges immediate patching of Ivanti Connect Secure due to an actively exploited authentication bypass vulnerability, CVE-2026-104935. The zero-day allows [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mxtmczxelm2v"}, {"timestamp": "2026-10-14T13:10:38.162Z", "date_only": false, "value": "2026-10-14T13:10:38.162736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jgreig.bsky.social/post/3mxtmo4j7hk2k", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9a76aa00-7895-411b-bd11-a862ce8c6f4b", "content": "CISA and Ivanti released urgent warnings this week about CVE-2026-104935 \u2014 a bug found in Ivanti\u2019s Connect Secure product \n\ntherecord.media/new-ivanti-m...", "url": "https://bsky.app/profile/jgreig.bsky.social/post/3mxtmo4j7hk2k"}, {"timestamp": "2026-10-14T13:35:42.012Z", "date_only": false, "value": "2026-10-14T13:35:42.012547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxto2x3gev2h", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "da65bd56-1f66-4f12-b013-bc1214dcc0c0", "content": "(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-104935 \u2013 Ivanti Connect Secure Authentication Bypass by Spoofing\u00a0Vulnerability\n\nCVE-2026-104935 calls for version-specific review of Ivanti Connect Secure deployments. This technical brief covers vulnerability impact,\u2026\n\nhttps://thecybermind.co/kjcm", "url": "https://bsky.app/profile/thecybermind.co/post/3mxto2x3gev2h"}, {"timestamp": "2026-10-14T14:02:21.998Z", "date_only": false, "value": "2026-10-14T14:02:21.998675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mxtpknfpqp2l", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b4e2126e-9aea-4e22-a750-9aae07b54ce9", "content": "CISA issues urgent warning for actively exploited zero-day CVE-2026-104935 in Ivanti Connect Secure. The auth bypass flaw allows RCE. Patch immediately. #Ivanti #ZeroDay #CVE #InfoSec\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mxtpknfpqp2l"}, {"timestamp": "2026-10-14T14:02:30.490Z", "date_only": false, "value": "2026-10-14T14:02:30.490196Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117439628070074803", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "944a1687-f82b-48d0-b5eb-def6de26a918", "content": "\ud83d\udcf0 CISA Warns of Actively Exploited Zero-Day in Ivanti Connect Secure\nCISA issues urgent warning for actively exploited zero-day CVE-2026-104935 in Ivanti Connect Secure. The auth bypass flaw allows RCE. Patch immediately. #Ivanti #ZeroDay #CVE #InfoSec\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-warns-of-actively-exploited-ivanti-connect-secure-zero-day/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117439628070074803"}, {"timestamp": "2026-10-14T14:06:27.655Z", "date_only": false, "value": "2026-10-14T14:06:27.655851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mxtprxmt6j2d", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "95d6c14c-1ac0-4f87-b4e5-bf34ac16f4af", "content": "A critical zero-day in Ivanti Connect Secure gateways is actively exploited, prompting urgent patching advisories from Ivanti and CISA to protect affected organizations.\n\nCVE-2026-104935 #ZeroDay #Flaw #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mxtprxmt6j2d"}, {"timestamp": "2026-10-14T15:00:01Z", "date_only": false, "value": "2026-10-14T15:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-104935", "field": "timestamps.recorded_at", "uuid": "daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T15:01:11.904Z", "date_only": false, "value": "2026-10-14T15:01:11.904290Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b5559f38-8f83-4c25-91c4-3501b08e6252", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/daf14c26-cd14-4abd-b3bf-2a0d6d73a7f1"}, {"timestamp": "2026-10-14T15:16:30.554Z", "date_only": false, "value": "2026-10-14T15:16:30.554074Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxttp6wr7dgd", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a1585377-0350-44bd-90bf-ac5ed06941be", "content": "CISA KEV | CVE-2026-104935 | Ivanti / Connect Secure\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1267", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxttp6wr7dgd"}, {"timestamp": "2026-10-14T15:29:05.985Z", "date_only": false, "value": "2026-10-14T15:29:05.985382Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacks.gr/post/3mxtufpxenm7l", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b83af493-1549-431f-a7d8-1712e8ccc0af", "content": "CISA urges immediate updates for Ivanti Connect Secure appliances facing active exploitation of authentication bypass vulnerability CVE-2026-104935, allowing unauthenticated remote comman\u2026\n\nhttps://en.hacks.gr/amesi-enimerosi-zita-i-cisa-gia-systimata-ivanti-logo-epitheseon/\n\n#Ivanti #CISA #Security", "url": "https://bsky.app/profile/hacks.gr/post/3mxtufpxenm7l"}, {"timestamp": "2026-10-14T15:47:57.498Z", "date_only": false, "value": "2026-10-14T15:47:57.498482Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvheoals2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9c117ccc-59a9-4a86-988a-a93e5b83ed51", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvheoals2w"}, {"timestamp": "2026-10-14T15:47:57.997Z", "date_only": false, "value": "2026-10-14T15:47:57.997674Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4nf22w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "075e5375-a76a-4318-a2d4-8e09436dbefa", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4nf22w"}, {"timestamp": "2026-10-14T15:47:58.421Z", "date_only": false, "value": "2026-10-14T15:47:58.421247Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4oec2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "4e23be33-e28a-42ce-b57c-33a6b4142cb3", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4oec2w"}, {"timestamp": "2026-10-14T15:47:58.838Z", "date_only": false, "value": "2026-10-14T15:47:58.838669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4qcs2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "cf7abe17-913a-4c96-824d-5359e571f695", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4qcs2w"}, {"timestamp": "2026-10-14T15:47:59.275Z", "date_only": false, "value": "2026-10-14T15:47:59.275516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4rc22w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "0a2f2764-6e6d-4049-868c-fe58c24f1072", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4rc22w"}, {"timestamp": "2026-10-14T15:47:59.708Z", "date_only": false, "value": "2026-10-14T15:47:59.708192Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4sbc2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "10cabb14-9e44-48b0-8c39-89585f2b75aa", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4sbc2w"}, {"timestamp": "2026-10-14T15:48:00.143Z", "date_only": false, "value": "2026-10-14T15:48:00.143528Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4sbd2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "26550d5f-2bdd-4c00-95e6-fc395ccfebb9", "content": "3/7 Ivanti says its Connect Secure VPN flaw (CVE-2026-104935) has been exploited since at least Oct 3, even on patched devices. Over 5,500 instances are exposed per Shadowserver. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mxtvhh4sbd2w"}, {"timestamp": "2026-10-14T16:07:27.708Z", "date_only": false, "value": "2026-10-14T16:07:27.708423Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mxtwkdlche24", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "23533665-e785-4e6b-9d9b-9af3d30d86d9", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\n\nLa vuln\u00e9rabilit\u00e9 CVE-2026-CVE-2026-104935 permet \u00e0 un attaquant non authentifi\u00e9 l'ex\u00e9cution de code arbitraire \u00e0 distance dans Ivanti Connect Secure. Elle est activement exploit\u00e9e.\ncert.cyber.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mxtwkdlche24"}, {"timestamp": "2026-10-14T16:07:30.865Z", "date_only": false, "value": "2026-10-14T16:07:30.865745Z", "kind": "sighting", "label": "Seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117440121825466563", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "347b815e-f3be-4722-b891-1b13fb12a2d6", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\nLa vuln\u00e9rabilit\u00e9 CVE-2026-CVE-2026-104935 permet \u00e0 un attaquant non authentifi\u00e9 l'ex\u00e9cution de code arbitraire \u00e0 distance dans Ivanti Connect Secure. Elle est activement exploit\u00e9e.https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-013/", "url": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117440121825466563"}, {"timestamp": "2026-10-14T17:01:20.627Z", "date_only": false, "value": "2026-10-14T17:01:20.627821Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxtzko7bxm26", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b122b701-af38-42d9-9517-3e87e5a12454", "content": "Ivanti Connect Secure\u306b\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027(CVE-2026-104935)\u304c\u767a\u898b\u3055\u308c\u3001CISA\u304c\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63a8\u5968\u3002\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8\u3067105\u4ef6\u306e\u653b\u6483\u8a66\u884c\u304c\u8a18\u9332\u3055\u308c\u305f\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxtzko7bxm26"}, {"timestamp": "2026-10-14T17:58:52.588Z", "date_only": false, "value": "2026-10-14T17:58:52.588094Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxu4rkzbr32h", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "8e72e0e7-4e07-4c26-88dd-7dd297967742", "content": "Shadowserver tracks over 5,600 Internet-exposed Ivanti Connect Secure hosts as CISA adds CVE-2026-104935 to its actively exploited list and orders federal agencies to patch by Friday.", "url": "https://bsky.app/profile/thecircuitry.to/post/3mxu4rkzbr32h"}, {"timestamp": "2026-10-14T18:15:30.385Z", "date_only": false, "value": "2026-10-14T18:15:30.385880Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "741d9aa2-829a-4382-a78c-6d2b95b97c31", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-104935 \u00b7 30 people \ud83d\udd25\n2. CVE-2026-96951 \u00b7 29 people \ud83d\udd25\n3. CVE-2026-97229 \u00b7 10 people\n4. CVE-2026-105445 \u00b7 9 people\n5. CVE-2026-74580 \u00b7 9 people\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc3usk2q"}, {"timestamp": "2026-10-14T18:15:30.918Z", "date_only": false, "value": "2026-10-14T18:15:30.918100Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc6ay22q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9999fe1e-50bd-4c6d-8339-fa8cdd0310b0", "content": "1. CVE-2026-104935 \u00b7 30 people \ud83d\udd25\n\ud83d\udfe7 High 8.6 \u00b7 Ivanti Connect Secure\n\nAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxu5pc6ay22q"}, {"timestamp": "2026-10-14T18:24:34.534Z", "date_only": false, "value": "2026-10-14T18:24:34.534357Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxu67inslq24", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "9f790576-057d-46ec-8f59-e1f5d465a70a", "content": "CISA urges updating Ivanti Connect Secure due to CVE-2026-104935, an actively exploited authentication bypass enabling remote unauthenticated arbitrary command execution.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mxu67inslq24"}, {"timestamp": "2026-10-14T18:24:57.994Z", "date_only": false, "value": "2026-10-14T18:24:57.994459Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxu6a7h2dt2v", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "bcd6b465-164e-4ed7-aa55-bb0af65eb36d", "content": "CISA urges updating Ivanti Connect Secure due to CVE-2026-104935, an actively exploited authentication bypass enabling remote unauthenticated arbitrary command execution.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mxu6a7h2dt2v"}, {"timestamp": "2026-10-14T18:27:11.773Z", "date_only": false, "value": "2026-10-14T18:27:11.773599Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mxu6e6gkvj2g", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "894e8c0f-1d63-4616-b052-7ad4584bb32b", "content": "CISA urges updating Ivanti Connect Secure due to CVE-2026-104935, an actively exploited authentication bypass enabling remote unauthenticated arbitrary command execution.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mxu6e6gkvj2g"}, {"timestamp": "2026-10-14T18:53:20.166Z", "date_only": false, "value": "2026-10-14T18:53:20.166321Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxu7swvs4y2g", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "3ec842a4-cbec-4434-bfd7-a3f5cfb73c5a", "content": "\ud83e\udd16 CVE-2026-104935 (CVSS 8.6): auth bypass in Ivanti Connect Secure, exploited as a 0-day since Oct 1. CISA added it to KEV; honeypots logged 105 exploit attempts. Patch now.\nhttps://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mxu7swvs4y2g"}, {"timestamp": "2026-10-14T19:38:38.428Z", "date_only": false, "value": "2026-10-14T19:38:38.428443Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxucdwvimu2l", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "ad1f9d99-a107-41e4-b8a9-aef6a965a817", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-104935 \u2013 Ivanti Connect Secure Authentication Bypass by Spoofing\u00a0Vulnerability\n\nExecutive briefing on CVE-2026-104935 impacting Ivanti Connect Secure, featuring active exploitation telemetry, backdoor removal\u2026\n\nhttps://thecybermind.co/veou", "url": "https://bsky.app/profile/thecybermind.co/post/3mxucdwvimu2l"}, {"timestamp": "2026-10-14T21:00:27.123Z", "date_only": false, "value": "2026-10-14T21:00:27.123074Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxugwabppv2q", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "10356c57-0d92-46a9-a9eb-d81c49ec72d9", "content": "CISA urged immediate patching of Ivanti Connect Secure flaw CVE-2026-104935, exploited since at least October 1. Ivanti released fixes; defenders should investigate for compromise and follow CISA\u2019s recovery steps.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxugwabppv2q"}, {"timestamp": "2026-10-14T21:48:32.269Z", "date_only": false, "value": "2026-10-14T21:48:32.269163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxujm7pdpe2v", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "d999e248-5a7f-4eba-b394-6e18a2adaf4e", "content": "CISA urges immediate patching of actively exploited Ivanti Connect Secure authentication-bypass flaw CVE-2026-104935. Reports describe credential theft and data exfiltration; honeypots recorded 105 exploit attempts by October 14.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxujm7pdpe2v"}, {"timestamp": "2026-10-15T05:55:56.260Z", "date_only": false, "value": "2026-10-15T05:55:56.260847Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxvetrj7bc2h", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "615650ed-d9eb-4e86-8d90-ff45f78e68c1", "content": "\ud83d\udd13 Ivanti Connect Secure : CVE-2026-104935 exploit\u00e9e en 0-day depuis le 1er octobre. Alerte CERT-FR + injonction CISA de patcher imm\u00e9diatement. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-013/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxvetrj7bc2h"}, {"timestamp": "2026-10-15T06:21:55.712Z", "date_only": false, "value": "2026-10-15T06:21:55.712817Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "96baced5-db53-4e6a-9e99-b12b3b80266c", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 62 interactions\nCVE-2026-97229: 36 interactions\nCVE-2026-104935: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-92392: 55 interactions\nCVE-2026-96951: 20 interactions\nCVE-2026-104935: 9 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxvgcaicci25"}, {"timestamp": "2026-10-15T06:35:57.657Z", "date_only": false, "value": "2026-10-15T06:35:57.657560Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxvh3dnxan2b", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "7534feb2-a778-4275-8fcd-072f2385d49a", "content": "Time's moving faster than it should, and CISA put CVE-2026-104935 on the known exploited list back on October 13, which means federal agencies have until tomorrow (October 16) to patch it.\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxvh3dnxan2b"}, {"timestamp": "2026-10-15T06:51:26.388Z", "date_only": false, "value": "2026-10-15T06:51:26.388132Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxvhwxehqdpc", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "00cc34b0-848d-4868-ada8-868ec1509634", "content": "Incident Radar | CISA Reports Active Exploitation of Ivanti Connect Secure Authentication Bypass\n\nCISA reports that threat actors are actively exploiting CVE-2026-104935, a zero-day authentication bypass\u2026\n\nSource: CISA Cybersecurity Advisories\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1271", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxvhwxehqdpc"}, {"timestamp": "2026-10-15T09:23:14.483Z", "date_only": false, "value": "2026-10-15T09:23:14.483363Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mxvqgaptik2v", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "0bcca597-c270-44e6-a683-fa46ba47b9b1", "content": "\u26a0\ufe0f Vuln\u00e9rabilit\u00e9 Ivanti Connect Secure (ICS)\n\n\ud83d\udce2 Le CERT-FR a publi\u00e9 un bulletin d'alerte sur la vuln\u00e9rabilit\u00e9 CVE-2026-104935, activement exploit\u00e9e. \n\n\u27a1\ufe0f Plus d'informations sur :\n\ud83d\udd17 cert.cyber.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mxvqgaptik2v"}, {"timestamp": "2026-10-15T13:15:18.267Z", "date_only": false, "value": "2026-10-15T13:15:18.267486Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/jbhall56/statuses/117445107239719716", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "2d329213-daf3-48e2-894e-7411ae7a784a", "content": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching", "url": "https://infosec.exchange/users/jbhall56/statuses/117445107239719716"}, {"timestamp": "2026-10-15T13:15:29.782Z", "date_only": false, "value": "2026-10-15T13:15:29.782827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mxw5fmymkk2e", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "8262e936-51ff-483d-915e-035e30a85d5d", "content": "CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. www.darkreading.com/vulnerabilit...", "url": "https://bsky.app/profile/jbhall56.bsky.social/post/3mxw5fmymkk2e"}, {"timestamp": "2026-10-15T14:37:14.869Z", "date_only": false, "value": "2026-10-15T14:37:14.869996Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/censys.bsky.social/post/3mxwbxvyo6h25", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "a75331a6-eecb-440d-8507-37214623ec7b", "content": "\ud83d\udea8 Rapid Response: Ivanti Connect Secure CVE-2026-104935 (CVSS 8.6) is actively exploited and on CISA's KEV list.\n\nCensys sees 7,604 exposed hosts and 269,319 web properties (not confirmed vulnerable).\nCensys ARC advisory: https://bit.ly/4jplTIr", "url": "https://bsky.app/profile/censys.bsky.social/post/3mxwbxvyo6h25"}, {"timestamp": "2026-10-15T19:13:10.123Z", "date_only": false, "value": "2026-10-15T19:13:10.123852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/qubblelabs.com/post/3mxwrfdacwc2b", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "177485bf-34b3-43dc-891c-ae8f31018fed", "content": "DarkReading: Ivanti ICS CVE-2026-104935 auth bypass + RCE only \"partially patched\" in July. Threat actors exploited the gap.\n\nThe patch arrives via the same code-signing trust chain the vuln bypasses.", "url": "https://bsky.app/profile/qubblelabs.com/post/3mxwrfdacwc2b"}, {"timestamp": "2026-10-15T20:04:33.286Z", "date_only": false, "value": "2026-10-15T20:04:33.286436Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxwub6enol2z", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "fc2d92c7-af8f-430c-9693-06a1ab67c17f", "content": "@talosintelligence.com\nCVE growth outpaced KEV, but patch debt and UAT-6275 espionage targeting CIS government and critical infrastructure remain urgent.\n-\nIOCs: UAT-6275, CVE-2026-104935\n-\n#CyberEspionage #ThreatIntel #Vulnerabilities", "url": "https://bsky.app/profile/cyfar.ca/post/3mxwub6enol2z"}, {"timestamp": "2026-10-15T21:22:53.212Z", "date_only": false, "value": "2026-10-15T21:22:53.212478Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447024484079888", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b0333f5a-35d9-4f99-8b53-a6a5304d4279", "content": "CVE-2026-111357  Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111357https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935#ivanti #Ivanti #ConnectSecure#CVE_2026_111357#bot", "url": "https://infosec.exchange/users/cve/statuses/117447024484079888"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": true, "value": "2026-10-16", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-104935", "field": "evidence.0.details.due_date", "uuid": "1de65794-4de9-442e-9a39-299bf381cadf", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-16)", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "f75c06e4-250e-46b3-899e-8394341dc52c"}, {"timestamp": "2026-10-16T03:34:59.873Z", "date_only": false, "value": "2026-10-16T03:34:59.873262Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lemagit.bsky.social/post/3mxxngntgzp2c", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "162429bc-b5e7-4751-8d5c-4893a001dc85", "content": "Ivanti Connect Secure (CVE-2026-104935) : Attention au-del\u00e0 du patch. Apr\u00e8s l'attaque (logs effac\u00e9s, secrets AD vis\u00e9s), la rotation des cl\u00e9s et l'analyse post-mortem sont cruciales. \u26a0\ufe0f #Cybers\u00e9curit\u00e9 [lire]", "url": "https://bsky.app/profile/lemagit.bsky.social/post/3mxxngntgzp2c"}, {"timestamp": "2026-10-16T06:18:47.148Z", "date_only": false, "value": "2026-10-16T06:18:47.148208Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b7f97a9a-2116-4ef2-9a2a-fdec89c1b1fc", "content": "Top 3 CVE for last 7 days:\nCVE-2026-92392: 65 interactions\nCVE-2026-104935: 46 interactions\nCVE-2026-97229: 38 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0322: 21 interactions\nCVE-2026-99999: 15 interactions\nCVE-2026-102764: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxxwlkash52j"}, {"timestamp": "2026-10-16T06:37:52.749Z", "date_only": false, "value": "2026-10-16T06:37:52.749688Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mxxxnox7py2w", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "ca40a226-ff7a-4688-8eda-d7ad254ccec2", "content": "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure\n\nThis article centers its urgency on the immediate threat of CVE-2026-104935, yet it heavily pivots toward remediation advice after framing the core exploitability. Given that the integrity checker explicitly ma\u2026\n\nvia US-CERT", "url": "https://bsky.app/profile/arc-codex.com/post/3mxxxnox7py2w"}, {"timestamp": "2026-10-16T08:00:11.684Z", "date_only": false, "value": "2026-10-16T08:00:11.684903Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mxy4aujjpm2x", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "45208274-04a3-4c35-9da8-36d643a1e092", "content": "Ivanti Connect Secure: three chained zero-days gave root on a patched VPN (CVE-2026-104935, CVSS 8.6, in CISA KEV). As of Oct 14, no fix for the root flaw. Integrity Checker misses it. #Ivanti #ZeroDay #CyberSecurity\n\ndiesec.com/2026/10/ivan...\ndiesec.com/de/2026/10/i...", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mxy4aujjpm2x"}, {"timestamp": "2026-10-16T08:08:21.214Z", "date_only": false, "value": "2026-10-16T08:08:21.214172Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mxy4pfe4x52n", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "ecc96eb7-de42-4a94-812b-abe1ad29f25e", "content": "COGNOSCERE Tech Brief \u2014 2026-10-16\n\nCISA added Ivanti Connect Secure CVE-2026-104935 to its Known Exploited Vulnerab\n\nhttps://youtube.com/watch?v=oof6cK6NHYE\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mxy4pfe4x52n"}, {"timestamp": "2026-10-16T16:03:51.085Z", "date_only": false, "value": "2026-10-16T16:03:51.085171Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxyx5tzc7y2y", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "721136a9-389e-463a-a54b-c23c8781474b", "content": "~Cybergcca~\nBeyondTrust and Ivanti flaws are exploited in the wild; updates are urged.\n-\nIOCs: CVE-2026-102764, CVE-2026-104935, CVE-2026-111357\n-\n#CVE #ThreatIntel #Vulnerabilities", "url": "https://bsky.app/profile/cyfar.ca/post/3mxyx5tzc7y2y"}, {"timestamp": "2026-10-16T17:25:20.294Z", "date_only": false, "value": "2026-10-16T17:25:20.294316Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxz3tgpda226", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "b657c436-801a-48a4-9798-7fff7066d9da", "content": "Federal agencies have until today to patch the Ivanti Connect Secure authentication bypass (CVE-2026-104935) and the Microsoft Windows command injection flaw (CVE-2026-96951). The rest of us?\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxz3tgpda226"}, {"timestamp": "2026-10-17T04:03:59.516Z", "date_only": false, "value": "2026-10-17T04:03:59.516690Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3my27jgpj4a26", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "12f02718-0869-4efb-9069-4222e2c073b4", "content": "BREAKING: Critical authentication bypass + RCE flaw (CVE-2026-104935) discovered in enterprise application framework, allowing attackers full system access without credentials. Anthropic's 'SneakPeek' zero-click threat targets LLM APIs via crafted inputs; SonicWall SMA devices under active attack", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3my27jgpj4a26"}, {"timestamp": "2026-10-17T05:01:59.314Z", "date_only": false, "value": "2026-10-17T05:01:59.314343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3my2cr5hskp2f", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "698dfc87-f62b-4b6f-ad94-e76071937f24", "content": "Daily IT Security Digest \u2014 2026-10-17\nCitrix, Fortinet and Ivanti jointly addressed 29 vulnerabilities across their product lines, including a critical Ivanti Connect Secure VPN zero-day (CVE-2026-104935) confirmed under active exploitation. The advisory also resolved GUI-critical bugs in FortiSIEM", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3my2cr5hskp2f"}, {"timestamp": "2026-10-17T08:11:15.573Z", "date_only": false, "value": "2026-10-17T08:11:15.573764Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3my2ndkbuie22", "record": "CVE-2026-104935", "field": "creation_timestamp", "uuid": "d172c9ce-cd71-4f83-9599-bf484141baf2", "content": "COGNOSCERE Tech Brief \u2014 2026-10-17\n\nCISA added CVE-2026-104935, a CVSS 8.6 authentication bypass in Ivanti Connect S\n\nhttps://youtube.com/watch?v=SZwVYCYZcek\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3my2ndkbuie22"}]}