Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Ivanti Connect Secure chain (CVE-2026-104935, then CVE-2026-111357 / -118527)
Auth bypass exploited from 1 to 3 Oct (Defused, Volexity UTA0576), chained to root on fully patched devices.
- Disclosed
What happened
- Fix and KEV for -104935: 13 Oct 2026. The other two were added to KEV on 30 Oct after Ivanti’s 29 Oct update.
- Fixed versions differ by source (25.1.1.2 or 25.1.3.0): check the advisory.
Live scores
Live scores
CVE-2026-104935- EPSS
- 0.868
very likely to be attacked soon - VEDAS
- 0.988
strong exploit evidence - On CISA KEV
- Yes, since 2026-10-13
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-111357- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.516
some exploit evidence - On CISA KEV
- Yes, since 2026-10-30
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2026-118527- On CISA KEV
- Yes, since 2026-10-30
- Detection rule
- None yet
Sources
- https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/
- https://securityaffairs.com/202175/security/u-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-catalog.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.