Attackers exploit an Ivanti Connect Secure zero-day to steal Active Directory secrets

Ivanti fixed CVE-2026-104935 in Connect Secure after attackers used it as a zero-day to run commands on a VPN appliance and take Active Directory secrets. A Bricksforge WordPress flaw is under attack, Fortinet fixed critical FortiSIEM and FortiSandbox flaws, and BSI and CERT.at responded to the attacks on the cooling systems of French retail chains.

Vulnerabilities

CVE-2026-104935 - Ivanti Connect Secure, CVSS 3.1 8.6

What it allows. An authentication bypass lets an unauthenticated attacker run arbitrary commands on the VPN appliance. Ivanti’s advisory of 13 October says it is “aware of exploitation affecting a limited number of customers at the time of disclosure”, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day. Volexity, which reported it, saw a group it tracks as UTA0576 exploit it from 3 October against an appliance that was fully patched at the time, on 22.8R2.4, chaining it with a privilege escalation flaw to run commands as root. The attacker queried Active Directory for secrets including LAPS passwords and BitLocker recovery keys and took the results, sprayed passwords against Active Directory accounts, and deleted entries from the appliance’s debug and audit logs, without leaving a web shell behind. Volexity assesses with low confidence that the group’s motives are criminal rather than espionage.

Affected. Ivanti Connect Secure 22.8R2.4 and earlier 22.8 releases, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Releases 22.7R2.14 and earlier are not affected, nor are 25.1.3.0 and later.

Fix. Update to 25.1.1.2, 25.1.3.0, 25.1.3.1 or 22.8R2.5, as the advisory lists; 25.1.3.0 and later need the newer ISA4500, ISA6500 or ISA8500 platform, and 22.7 and 22.8 reach end of life on 31 January 2027. Volexity says the privilege escalation flaw in the chain is not fixed yet, with a fix due “in the coming weeks”, and that Ivanti’s Integrity Checker Tool may not detect a compromise, because the chain changes code only in memory. It advises watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi and for requests whose X-DSCGI-PATH header does not match the URL path, checking /tmp/, and running memory and network forensics on any appliance suspected of compromise.

Exposure. product:"Pulse Secure" http.title:"Ivanti Connect Secure" matches 1,157 results worldwide; Shodan still fingerprints Connect Secure under its former name, Pulse Secure.

Shodan reads a version from 288 of them, and none is an affected 22.8 or 25.1 release: 275 run 9.0, 9.1 or a release from 22.1 to 22.7, which the flaw does not affect. The rest carry no version, so these are exposed instances, not confirmed vulnerable ones. 900 of the results answer on port 443 and 245 run at a cloud provider.

CVE-2026-85097 - Bricksforge for WordPress, CVSS 3.1 9.8

What it allows. Bricksforge, an add-on for the Bricks Builder WordPress site builder, trusts file metadata the client sends when a form is submitted, so an unauthenticated attacker can upload a file and have it run as PHP code on the server. Patchstack, which rates it CVSS 10.0, has seen exploitation attempts since 7 October, and SK-CERT warned on 13 October that the flaw is actively exploited. The same warning covers two more exploited flaws, both stored cross-site scripting that NVD lists at CVSS 7.2: CVE-2026-93836 in WPC Product Bundles for WooCommerce, fixed in 8.6.7, and CVE-2026-94504 in Ninja Forms, fixed in 3.15.4.

Affected. Bricksforge 3.1.8.9 and earlier. The attacker needs no account.

Fix. Update to Bricksforge 3.1.8.10 or later, per Patchstack. SK-CERT also advises checking logs for exploitation attempts, and checking the integrity of the database and of the site itself.

CVE-2026-106173 - Fortinet FortiSIEM, CVSS 3.1 9.8

What it allows. A path traversal in FortiSIEM may let an unauthenticated attacker execute unauthorised code or commands through specially crafted packets, according to Fortinet’s FG-IR-26-180 of 13 October. Fortinet rates it critical, shows a score of 9.4 on the advisory, found the flaw itself and does not list it as exploited.

Affected. FortiSIEM 7.5.0. Fortinet lists 7.6 and FortiSIEM Cloud as not affected.

Fix. Upgrade to 7.5.1 or later. Until then, Fortinet says restricting access to TCP port 27918 prevents the issue.

CVE-2026-49950 - Xorbits Xoscar, CVSS 3.1 9.8

What it allows. Xoscar, a Python actor framework that the Xinference model-serving platform depends on, passes data it receives on its actor-pool TCP channel to cloudpickle.loads() before it checks the message type. A remote unauthenticated attacker can therefore run code as the server process, “which commonly runs as root on GPU nodes”, according to VulnCheck’s advisory of 13 October. No source reports exploitation.

Affected. Xoscar 0.1.0 through 0.11.2, where the attacker can reach the actor-pool port.

Fix. There is no fixed release: 0.11.2 is the newest on PyPI, and VulnCheck gives no workaround.

FG-IR-26-185 - Fortinet FortiSandbox, CVSS 3.1 9.8

What it allows. An authentication bypass through an alternate path in the FortiSandbox web interface may let a remote unauthenticated attacker get past authentication with crafted HTTP requests, and Fortinet gives the impact as executing unauthorised code or commands. Its advisory of 13 October rates the flaw critical and does not list it as exploited; it shows a score of 9.6, though the base metrics of the CVSS vector it links score 9.8. It names CVE-2026-107656, which has no public CVE record yet.

Affected. FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and every 4.4 release. 5.2 is not affected.

Fix. Upgrade to 5.0.7 or 4.4.10 or later; FortiSandbox PaaS 4.4 has to move to a fixed release. Fortinet gives no workaround.

Exposure. http.title:"FortiSandbox" matches 45 results worldwide.

No banner carries a FortiSandbox version, so these are exposed instances, not confirmed vulnerable ones. 43 of the results answer on port 443 and 17 run at a cloud provider.

APT activity

• Genians attributes to Kimsuky, a group it describes as linked to North Korea, a campaign against Ukrainian experts in diplomacy, security and international policy: fake conference invitations and research requests led to shortcut files posing as documents and a fake Zoom installer, with payloads and stolen data moved through GitHub, GitLab and Codeberg, and most of the attempts it observed failed. Genians suggests the group is after intelligence on the war, including North Korean troop losses and the handling of prisoners of war, and The Record reported the findings on 13 October. Genians advises hunting for abuse of LNK files, PowerShell and GitHub, and examining which processes reach GitHub, GitLab and Codeberg rather than blocking those services outright.

Regional

• Attackers manipulated the cooling systems of several French retail chains on the night of 11 to 12 October so that frozen goods were heated and made unusable, CERT.at wrote on 13 October, and it found the relevant web interfaces on only four Austrian addresses: one at a bakery already on current firmware and three at a restaurant chain, partly on very old software, which it is notifying directly. The same day Germany’s BSI urged operators of small installations, such as food refrigeration or power generation, to cut direct internet access to control systems, put access behind a VPN with multi-factor authentication and patch promptly, warning that the attack could have hit any country and may find copycats. CERT-FR’s alert names Danfoss AK-SM and AK-SC and Copeland and Dixell XWEB remote controllers, and advises taking them off the internet, checking the whole configuration including defrost schedules, factory-resetting any that are compromised, updating firmware and changing default passwords.
• Innocon, which develops the online town hall portal of Tangerhuette in Saxony-Anhalt, told MDR on 13 October that the attack that took the portal offline in September exploited a flaw in its software it had not known of, and that it classifies the attack as AI-driven, because commands ran faster than a person could enter them and the attack code was developed further on the town’s server during the attack. Four other municipalities took their portals offline as a precaution, without signs of an attack, and Innocon says the attackers reached only test accounts and took no real data. The state criminal police office is investigating for data espionage and can neither confirm nor deny that AI was used.
• Investigators now assume that the attack on the town administration of Eichstätt in Bavaria was ransomware, the Bavarian Central Office for Cybercrime told dpa, as Der Spiegel reported on 13 October, though they cannot yet say where the attack came from or whether data was taken. The town has taken all its servers offline as a precaution and is preparing for a longer outage, and still asks residents to be wary of messages that appear to come from it.

This digest is created with the help of AI-enabled tools and may contain inaccuracies. If you find one, let me know.