Ivanti oh no bb what is u doin?
> At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible. Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.
New Ivanti zero-days: CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable filenames)
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
#ivanti #cve #zeroday #eitw
ssvc
npub1dv…jfshx
2026-10-30 15:26:25 UTC
in reply to nevent1q…8666
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-10-30 15:26:25 UTCEvent JSON
{
"id": "0bc0203e48af779630a11b9a3cd478da47af1f542cba4a955ce8d9e3f9ddc921",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1793373985,
"kind": 1,
"tags": [
[
"t",
"eitw"
],
[
"t",
"zeroday"
],
[
"e",
"ba3521e3c13427e63af8c493daedda3ce358c2adda385b63e71ac5ab1f97f38d",
"",
"root",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"proxy",
"https://infosec.exchange/@ssvc/117530557480851009",
"web"
],
[
"t",
"ivanti"
],
[
"t",
"cve"
],
[
"e",
"08039970c53062dd12905b566d790d764bd932cb31b92f4d8bf9d3c6600b5860",
"",
"reply",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"p",
"6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117530557480851009",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117530557480851009",
"pink.momostr"
],
[
"-"
]
],
"content": "Ivanti oh no bb what is u doin?\n\n\u003e At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible. Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now. \n\nNew Ivanti zero-days: CVE-2026-111357 (missing authentication) and CVE-2026-118527 (predictable filenames)\n\nhttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US\n\n#ivanti #cve #zeroday #eitw",
"sig": "d10fd06e463f3a88d00a0df9562a78ff3ea6664a8bb547a189d571ab07b4584caba0808d40f7af82f78c6e34634bbe6a9007719d0171b5259c4c478b292647b8"
}