[CLSTR]
< Back to all clusters
[TECHNOLOGY] · United States · 8 sources

started · updated

Part of situation: CISA vulnerability exploitation and patching directives (12 clusters)

Cisco and Ivanti face active zero-day exploits in security infrastructure

zero-day vulnerability Cisco Secure Email Gateway Ivanti Connect Secure CVE-2026-76519 cybersecurity exploit

Major cybersecurity vulnerabilities have been identified in critical networking and security infrastructure from Cisco and Ivanti.

Cisco has reported active exploitation of a zero-day vulnerability in its Secure Email Gateway (CVE-2026-76519). The flaw, which carries a CVSS score of 9.8, allows unauthenticated remote attackers to write arbitrary files and execute commands with root privileges by sending a specially crafted email attachment. The vulnerability specifically affects devices where the Advanced Malware Protection (AMP) File Reputation service is enabled and Content Scanner Tools are older than version 25.3.0.5525. CISA has added this to its Known Exploited Vulnerabilities catalog and set a deadline for federal agencies to patch.

Separately, Ivanti Connect Secure (ICS) is facing exploitation involving a chain of three zero-day vulnerabilities. The primary flaw, CVE-2026-104935, has a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands. Security firm Volexity identified a threat actor, UTA0576, using these vulnerabilities to target credentials, Active Directory data, and BitLocker recovery keys. While Ivanti has released patches for two of the three vulnerabilities in the chain, a fix for the third remains pending.

Entities

CISA · Cisco · Ivanti · Ivanti Connect Secure · UTA0576 · UTA0576 · Volexity

Claims

What the coverage asserts, and how many sources carry each claim.

  • [● 2 SOURCES] CISA added the CVE-2026-104935 vulnerability to its Known Exploited Vulnerabilities catalog. therecord.media
  • [○ 1 SOURCE] Volexity believes the threat actor UTA0576 likely has criminal rather than espionage motivations. therecord.media
  • [● 3 SOURCES] Attackers used the access to target credentials, Active Directory data, LAPS passwords, and BitLocker recovery keys. therecord.media
  • [● 3 SOURCES] Ivanti confirmed limited exploitation of the vulnerability in the wild as of October 13, 2026. therecord.media
  • [● 3 SOURCES] Ivanti has released patches for two of the three zero-day vulnerabilities, with a fix for the third still pending. therecord.media
  • [● 2 SOURCES] The vulnerability CVE-2026-104935 has a CVSS severity score of 8.6. therecord.media
  • [● 4 SOURCES] Threat actor UTA0576 used a chain of three zero-day vulnerabilities to gain unauthenticated root access. therecord.media
  • [● 4 SOURCES] The exploitation was observed on an Ivanti Connect Secure appliance that was already running a fully patched version. therecord.media
  • [● 3 SOURCES] The Cisco vulnerability requires the File Reputation service to be enabled and Content Scanner Tools to be older than version 25.3.0.5525. www.blogspan.net · securityaffairs.com · www.theregister.com
  • [○ 1 SOURCE] CISA added the Cisco vulnerability to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to patch. www.theregister.com
  • [● 4 SOURCES] The CVE-2026-76519 vulnerability has a CVSS score of 9.8. www.blogspan.net · sempreupdate.com.br · securityaffairs.com · www.theregister.com
  • [● 5 SOURCES] Cisco confirmed active exploitation of a critical zero-day vulnerability in its Secure Email Gateway, tracked as CVE-2026-76519. www.it-boltwise.de · www.blogspan.net · sempreupdate.com.br · securityaffairs.com · www.theregister.com

Sources

CVE-2026-76519: Cisco SEG Zero-Day Exploited [socprime.com]
Cisco Secure Email Gateway: Zwei Zero-Days mit aktivem Exploit erfordern Updates [www.it-boltwise.de]
Cisco corrige falha zero-day crítica no Secure Email Gateway [sempreupdate.com.br]
Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise [securityaffairs.com]
Cisco Secure Email Gateway: Root-Lücke wird ausgenutzt [www.blogspan.net]
Cisco Secure Email Gateway: Zwei aktiv ausgenutzte Lücken erfordern Updates [borncity.com]
Cisco make-me-root email bug exploited as a 0-day by unknown crims [www.theregister.com]
CISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records [therecord.media]