> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak Flaws - URL: https://darkwebinformer.com/ivanti-patches-actively-exploited-connect-secure-zero-day-and-critical-credential-leak-flaws/ - Published: 2026-10-13T16:12:35.000Z - Updated: 2026-10-13T16:12:35.000Z - Author: Dark Web Informer - Tags: Vulnerabilities Ivanti has released security updates for an actively exploited Connect Secure zero-day and six additional vulnerabilities affecting Neurons Patch for Intune and Xtraction. The newly disclosed flaws include an authentication bypass that enables unauthenticated command execution and two critical credential-exposure vulnerabilities carrying CVSS scores of 9.9. ### Connect Secure Zero-Day Exploited in Attacks The actively exploited vulnerability, tracked as CVE-2026-104935, affects Ivanti Connect Secure remote-access gateways. It is an authentication bypass caused by spoofing that allows remote attackers to execute arbitrary commands without credentials or user interaction. Ivanti said it was aware of limited exploitation when the vulnerability was disclosed. The affected versions are: • Connect Secure 22.8R2.4 and earlier • Connect Secure 25.1.2.2 and earlier • Connect Secure 25.1.1.1 and earlier Administrators should review [Ivanti’s security advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en%5FUS), install the appropriate fixed release and regularly run the Integrity Checker Tool. Shadowserver was tracking more than 5,500 internet-exposed Connect Secure appliances when [BleepingComputer reported the vulnerability](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/). ### Critical Neurons Patch for Intune Vulnerability CVE-2026-109412 is a CVSS 9.9 vulnerability affecting Ivanti Neurons Patch for Intune, a cloud service used to manage third-party application updates through Microsoft Intune. The flaw allows a remotely authenticated attacker to access sensitive authentication information. Ivanti deployed the fix across all cloud environments on September 16, meaning customers do not need to install an update. However, the company recommends rotating the client secret associated with the Microsoft Entra ID application registration used for Intune publication. ### Xtraction Vulnerability Exposes Connector Credentials Ivanti also disclosed five vulnerabilities affecting Xtraction, its data analytics and reporting platform. The most serious, CVE-2026-106042, has a CVSS score of 9.9\. An authenticated attacker can redirect application requests to an attacker-controlled server and capture EPMM connector credentials transmitted by Xtraction. Four additional Xtraction vulnerabilities were addressed: • CVE-2026-106047 allows authenticated users to read arbitrary files through path traversal. • CVE-2026-106043 allows an unauthenticated attacker to create or modify a trusted site. • CVE-2026-106034 allows authenticated users to modify directories. • CVE-2026-106035 can expose SQL passwords through application logs. Xtraction 2026.2.1 and earlier is affected. Administrators should upgrade to version 2026.4 and rotate any EPMM connector credentials used by the application. ### Exploitation Limited to Connect Secure Flaw Ivanti has confirmed limited exploitation of CVE-2026-104935. The company said it was not aware of customers being compromised through the Neurons Patch for Intune or Xtraction vulnerabilities when the advisories were published. No public proof-of-concept exploits had been confirmed for those flaws. Additional technical details are available from [Ivanti’s October security update](https://www.ivanti.com/blog/october-2026-security-update).