Ivanti xavfsizlik yangilanishlarini e'lon qildi, bu yangilanishlar Connect Secure (ICS) masofaviy kirish shlyuzi zaifliklarini tuzatadi. Ushbu zaifliklar kamida 1-oktabrdan beri zero-day hujumlarda zanjirli tarzda ishlatilgan.
Tahdid aktorlari ushbu ikkita zaiflikni (CVE-2026-111357 va CVE-2026-118527) autentifikatsiyani chetlab o'tish zaifligi (CVE-2026-104935) bilan birga ishlatgan. Ivanti o'tgan oyda CVE-2026-104935 ni tuzatib, asosiy hujum yuzasini yo'q qilgan.
CVE-2026-111357 yuqori darajadagi imtiyozlarni oshirish zaifligi, CVE-2026-118527 esa autentifikatsiyalangan hujumchilarga tuzatilmagan qurilmaga fayllarni yuklash imkonini beradi.
Ivanti oktyabrda CVE-2026-104935 uchun tuzatishlar e'lon qilganida, administratorlarga iloji boricha tezroq yangilanishni tavsiya qilgan, chunki u "tabiatda cheklangan ekspluatatsiya" haqida xabardor edi.
"Ekspluatatsiya aniqlangan paytda, Ivanti CVE-2026-104935 uchun tuzatishni ishlab chiqqan edi, u allaqachon qo'llab-quvvatlanadigan versiyalar uchun QA'da edi va biz LPE aniqlanganda asosiy ekspluatatsiya yo'lini hal qiladigan tuzatishni mijozlarga yetkazishni kechiktirmaslik qarorini qabul qildik," deb Ivanti payshanba kuni yangilangan maslahatda qo'shimcha qildi.
"Shu sababli, bizning e'tiborimiz dastlab CVE-2026-104935 ni oshkor qilish va mijozlarimizni iloji boricha tezroq himoya qilishga qaratilgan edi."
Zaiflikni topgan kiberxavfsizlik firmasi Volexity o'sha paytda xabar bergan ediki, tahdid aktori (UTA0576) CVE-2026-104935 zaifligini kamida 3-oktabrdan beri boshqa ikkita zaiflik bilan zanjirli tarzda ishlatib, to'liq tuzatilgan ICS qurilmalarida autentifikatsiyasiz root darajasidagi kod ijrosini amalga oshirgan.
"E'tiborga molik jihati shundaki, UTA0576 hech qanday zararli dastur yoki veb-qobiq joylashtirmagan. Buning o'rniga, tahdid aktori qurilmani har bir buyruqni bajarish uchun qayta ekspluatatsiya qilgan va izlarini yashirish uchun jurnallarni buzgan, Ivanti Integrity Checker Tool'dan qochgan," deb Volexity aytdi.
Tahdid razvedkasi firmasi Defused ham Volexity hisobotini tasdiqlab, CVE-2026-104935 ekspluatatsiyasining birinchi belgilarini 1-oktabrdan boshlab kuzatganini aytdi.
Seshanba kuni AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) CVE-2026-104935 ni faol ekspluatatsiya qilinadigan zaifliklar katalogiga qo'shdi va federal agentliklarga tizimlarini juma kunigacha tuzatishni buyurdi.
Internet tahdid kuzatuvchisi Shadowserver hozirda 5 000 dan ortiq Internetga ochiq ICS nusxalarini kuzatmoqda, ammo davom etayotgan hujumlarga qarshi qancha qurilma allaqachon himoyalangani haqida ma'lumot yo'q.
Internetga ochiq Ivanti ICS nusxalari (Shadowserver)
Tahdid aktorlari Ivanti zaifliklarini tez-tez nishonga oladi, ko'pincha zero-day hujumlarda, chunki ular korporativ tarmoqlarga tez kirish va sezgir korporativ hamda mijoz ma'lumotlarini o'g'irlash yo'lini ta'minlaydi.
So'nggi bir necha yil ichida Ivanti Connect Secure'dagi bir nechta boshqa zero-day zaifliklarini tuzatgan, ularning ba'zilari keng tarqalgan hujumlarda zararli dasturlarni joylashtirish uchun zanjirli tarzda ishlatilgan.
U 2024-yil yanvar oyining boshida buyruq in'ektsiyasi (CVE-2024-21887) va autentifikatsiyani chetlab o'tish (CVE-2023-46805) zaifliklarini, ikki hafta o'tib esa server tomonidagi so'rovni soxtalashtirish (CVE-2024-21893) zaifligini tuzatgan.
Yaqinda Ivanti 2025-yil yanvarda masofaviy kod ijrosi (RCE) xatosini (CVE-2025-0282) va 2025-yil mart oyining o'rtalaridan beri Xitoy bilan bog'liq davlat xakerlari tomonidan ekspluatatsiya qilingan ikkinchi RCE zaifligini (CVE-2025-22457) tuzatgan.
Ivanti 3 000 dan ortiq xodimga, 7 000 dan ortiq hamkorlar tarmog'iga va butun dunyo bo'ylab IT aktivlarini boshqarish yechimlaridan foydalanadigan 40 000 dan ortiq mijozga ega.
2021-yil noyabridan beri CISA 38 ta Ivanti zaifligini faol ekspluatatsiya qilinadigan deb belgilagan, shu jumladan 12 tasi ransomware hujumlarida ham suiiste'mol qilingan.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
Threat actors exploited these two flaws (tracked asCVE-2026-111357andCVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivantipatched last monthto remove the main attack surface.
CVE-2026-111357 is a high-severity privilege escalation flaw, and CVE-2026-118527 lets authenticated attackers upload files on an unpatched device.
When it released patches for CVE-2026-104935 in October, Ivanti urged admins to upgrade as soon as possible since it was aware of "limited exploitation in the wild."
"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered,"Ivantiaddedin an advisory updated on Thursday.
"Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
Cybersecurity firm Volexity, which found the flaw,reported at the timethat a threat actor (UTA0576) was chaining the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to gain unauthenticated root-level code execution on fully patched ICS devices.
"Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool,"Volexity said.
Threat intelligence firm Defusedalso confirmed Volexity's report, saying that it spotted the first signs of active CVE-2026-104935 exploitation starting October 1.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA)added CVE-2026-104935to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday,
Internet threat watchdog Shadowservernow tracks over 5,000 Internet-exposed ICS instances, but there is no information on how many have already been secured against ongoing attacks.
Internet-exposed Ivanti ICS instances (Shadowserver)
Threat actors frequently target Ivanti vulnerabilities, often in zero-day attacks, because they provide a quick way into enterprise networks to steal sensitive corporate and customer data.
Over the past several years, Ivanti has patched several other Connect Secure zero-days exploited in the wild, some of them chained inwidespread attackstodeploy malware.
It addressed a command injection (CVE-2024-21887)and an authentication bypass (CVE-2023-46805)in early January 2024, and a server-side request forgery (CVE-2024-21893)two weeks later.
More recently, Ivanti has fixed a remote code execution (RCE) bug(CVE-2025-0282)in January 2025and a second RCE flaw (CVE-2025-22457)exploited by China-linked state hackerssince at least mid-March 2025.
Ivanti has over 3,000 employees, a network of more than 7,000 partners, and over 40,000 customers using its IT asset management solutions worldwide.
Since November 2021, CISA has flagged38 Ivanti vulnerabilitiesas actively exploited in the wild, including 12 that have also been abused in ransomware attacks.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
