Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
15 / 15 results
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day CVE-2026-104935 exploited since Oct 1
Ivanti Connect Secure (ICS) versions prior to 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2. Over 5,600 Internet-exposed ICS hosts identified globally. All unpatched ICS appliances are vulnerable to unauthenticated remote code execution.
highbug_reportVulnerabilityIvanti Connect Secure auth bypass exploited in wild; CISA orders patching
Ivanti Connect Secure (ICS) versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. All organizations running affected ICS VPN appliances are at risk of unauthenticated remote code execution.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day under active exploitation (RCE)
Ivanti Connect Secure (formerly Pulse Secure) - specific affected versions not disclosed in advisory. Remote code execution vulnerability with no CVE assigned yet.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day chain enables root RCE; third flaw unpatched
Ivanti Connect Secure VPN appliances before version 25.1.3.0 are affected. Versions 22.7R2.14 and earlier are not affected. Versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are patched for two of three flaws.
criticalbug_reportVulnerabilityIvanti Connect Secure zero-day CVE-2026-104935 exploited since Oct 3
Ivanti Connect Secure (ICS) versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Over 5,500 ICS instances exposed online. Affects SSL VPN appliances used for remote access to corporate and cloud resources.
criticalbug_reportVulnerabilityCritical RCE flaws in Ivanti Neurons for ITSM require immediate patching
Ivanti Neurons for ITSM (specific versions not disclosed in available data). Two vulnerabilities: missing authorization and insecure deserialization enabling remote code execution.
highbug_reportVulnerabilityIvanti EPM high severity flaws require immediate patching
Ivanti Endpoint Manager (EPM). Specific affected versions not disclosed in available advisory. CVE identifiers not yet assigned or published.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Ivanti Sentry flaw
Ivanti Sentry (specific versions not disclosed in summary). U.S. federal agencies under BOD 26-04 mandate, but all Ivanti Sentry deployments at risk given active exploitation.
criticalbug_reportVulnerabilityIvanti Sentry RCE flaw under active exploitation, root access possible
Ivanti Sentry (formerly MobileIron Sentry) - Internet-exposed secure mobile gateways. Specific vulnerable versions not provided in summary, but patch recently released.
criticalbug_reportVulnerabilityIvanti Sentry critical RCE and auth bypass require immediate patching
Ivanti Sentry (specific versions not disclosed in summary). Vulnerabilities enable root-level remote code execution and authentication bypass. CVE identifiers not yet assigned or published.
criticalbug_reportVulnerabilityFortinet FortiSandbox command injection flaw enables remote code execution
Fortinet FortiSandbox products affected by CVE-2026-25089 (CVSS 9.1). Specific vulnerable versions not disclosed in provided data. Ivanti and SAP also released patches for separate critical vulnerabilities.
criticalbug_reportVulnerabilityIvanti Sentry critical RCE flaws allow unauthenticated remote attacks
Ivanti Sentry products (specific versions not provided). Two critical vulnerabilities enable unauthenticated remote code execution on exposed devices.
criticalbug_reportVulnerabilityIvanti Sentry critical RCE allows unauthenticated root code execution
Ivanti Sentry secure mobile gateway solution. Specific affected versions not disclosed. Two critical vulnerabilities patched, including one maximum-severity (likely CVSS 10.0) remote code execution flaw enabling unauthenticated attackers to execute a…
highbug_reportVulnerabilityIvanti releases security updates for multiple products
Multiple Ivanti products affected. Specific product names, versions, and CVE identifiers not disclosed in available information. High severity rating indicates significant security risk.
criticalbug_reportVulnerabilityIvanti EPMM critical RCE flaws under limited exploitation
Ivanti Endpoint Manager Mobile (EPMM) products. Specific affected versions not provided in advisory summary. Two critical vulnerabilities enabling unauthenticated remote code execution.