BREAKING: Ivanti & Windows Zero-Days Hit CISA KEV List. Here is the Cure. If your security team hasn't…
Schomer — Founder
BREAKING: Ivanti & Windows Zero-Days Hit CISA KEV List. Here is the Cure.
If your security team hasn't analyzed yesterday’s emergency additions to the CISA Known Exploited Vulnerabilities (KEV) catalog, you are exposed. Attackers are actively bypassing VPN authentication and weaponizing malicious files to drop malware past corporate defenses.
We have analyzed the mechanics of both chains. Below is the technical breakdown and the step-by-step cure to secure your perimeter immediately.
🔍 Threat Mechanics: What We Are Up Against
• Ivanti Connect Secure (CVE-2026-104935): A critical Authentication Bypass by Spoofing flaw. Remote, unauthenticated attackers are abusing a spoofing vector to bypass core VPN controls, granting them direct memory access to run arbitrary commands.
• The In-Memory Blindspot: Standard endpoint and file system logs will miss this. Threat actors are modifying library code strictly inside system memory and wiping internal logs. Ivanti’s built-in Integrity Checker Tool will report a false "clean" status because it does not audit live running memory structures.
• Microsoft Windows Shell (CVE-2026-96951): A severe Command Injection bug that acts as a stealth delivery mechanism. It completely bypasses Mark of the Web (MotW) tags. When a user double-clicks an infected file via phishing email, Teams, or Slack, Windows skips Protected View warnings and runs the payload instantly.
4 reactions · 0 comments