Ivanti Connect Secure zero-day was used to run commands
On October 13, 2026, CISA said attackers were exploiting CVE-2026-104935, an authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated command execution. CISA added it to the exploited-vulnerabilities catalog the same day.