NewsDark Reading
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
Teaser from the source
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
This is the RSS-feed teaser. Read the full article at the original source.
Read at Dark ReadingLinked advisories
- CVE-2026-104935Ivanti Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-104935October 2026 Security Update
- CVE-2026-104935Ivanti Connect Secure: Schwachstelle ermöglicht die Umgehung von Authentifizierung und Codeausführung
- CVE-2026-104935Eine Schwachstelle zur Umgehung der Authentifizierung durch Spoofing in ICS vor Version 25.
More on Highlight
Other advisories
- Not ratedosv:CLEANSTART-2026-BL83922Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker
- Not ratedosv:CVE-2026-100521Cotonti through 1.0.0 Reflected XSS via search highlight parameter
- Not ratedosv:CVE-2026-52741GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
- Not ratedosv:CVE-2026-93956olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
- MediumCVE-2026-86790Das WordPress-Plugin WP Highlight Box bis Version 1.
- Not ratedosv:CVE-2026-53529LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)
- MediumCVE-2026-72639Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
- Not ratedosv:CVE-2026-72639Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service
Other news entries
- Networking problems after the October 2026 Windows update? NTLM might be to blameNewsThe Register — Security
- The AI Velocity Paradox: Why Security Is Decades Behind AI AmbitionNewsThe Hacker News
- Google’s bug bounty pause highlights growing AI vulnerability triage challengeNewsCSO Online
- Z.ai says sorry for slurping up your code, open sources ZCodeNewsThe Register — Security
- After spending billions, OpenAI still has gaps in its cybersecurityNewsCSO Online
- Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK BackdoorsNewsThe Hacker News
- Cisco Zero-Day Highlights API Endpoint Authentication IssuesNewsDark Reading
- MacOS 27 - First Boot, (Tue, Sep 15th)NewsSANS ISC Diary
Source: https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching
ID