DanSec

Vendor

Ivanti

In 52 briefs, most recently 2 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

38 Ivanti vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 12 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Google dismantles XCPE Android TV botnet, FBI links $6.3B Binance heist to TraderTraitor, and C3RB3R ransomware hits Synology NAS devices.
  2. Chainalysis breach, malicious Claude Code extension on Cursor exposing developers, and Ivanti Connect Secure root-access exploit chain.
  3. Covers the UK Legal Aid Agency and CenterPoint Energy breaches, Ivanti and Cisco zero-days under exploitation, and GhostAction compromising about 1,900 GitHub …
  4. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  5. ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
  6. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  7. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  8. Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
  9. Novo Nordisk trial data breach, Tchap messaging breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  10. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  11. Microsoft GitHub repos hijacked in Miasma worm supply chain attack, ServiceNow API breach, Russia-aligned WinRAR espionage, record 206 Patch Tuesday fixes.
  12. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  13. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  14. The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
  15. The Instructure/Canvas breach and ShinyHunters attacks, the Trellix source code theft by RansomHouse, and a Linux kernel LPE dubbed Dirty Frag.
  16. ShinyHunters breach of Instructure's Canvas disrupts colleges; RansomHouse claims Trellix breach; Daemon Tools supply chain attack contained.
  17. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  18. Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
  19. Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
  20. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  21. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  22. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  23. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  24. Sangoma FreePBX compromise with 900+ web shells, ManoMano breach of 38M users, and Juniper PTX critical RCE CVE-2026-21902.
  25. French FICOBA bank registry access exposing 1.2M accounts, Figure breach by ShinyHunters, and Ivanti zero-day exploitation surge.
  26. Over 300 malicious Chrome extensions with 37M+ downloads, Trezor and Ledger wallet phishing by mail, and actively exploited Ivanti EPMM RCE flaws.
  27. The Odido breach exposing 6.2M customers, Qilin's Conpet S.A. data theft, and BeyondTrust and Ivanti EPMM exploitation, plus threat actor and policy news.
  28. Conduent breach affects 25M+ people, a hijacked Outlook add-in steals Microsoft logins, and Apple and Microsoft ship major patch batches.
  29. Warlock ransomware breaches SmarterTools via unpatched SmarterMail, Conduent breach exposes Volvo customer data, Ivanti zero-days hit Dutch regulators.
  30. The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
  31. The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.
  32. The Trust Wallet Chrome extension theft, Ivanti EPMM zero-day attacks, and the DarkSpectre browser extension campaign hitting 2.2 million users.
  33. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  34. The 64M-record Barcelona data theft arrest, STAC6565 and QWCrypt attacks on Canadian firms, and Microsoft's December 2025 Patch Tuesday zero-days.
  35. Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
  36. F5 BIG-IP source code theft, Capita's £14M UK fine, and Clop's Oracle zero-day attack on Harvard.
  37. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  38. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  39. UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
  40. Iran-linked UNC1549 breaches European telecoms, Gamaredon and Turla team up on Ukraine, and ShinyHunters tied to healthcare breaches affecting 600K+ people.
  41. SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
  42. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  43. Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
  44. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  45. The Qantas breach (5.7M customers), Ingram Micro's SafePay ransomware attack, and McDonald's Paradox.ai hiring platform exposure.
  46. Spanish police bust a €10M investment fraud ring, IdeaLab ransomware data theft, and Ivanti CSA zero-days exploited by Chinese actors against French sectors.
  47. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  48. The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
  49. Chinese UAT-6382 exploits Trimble Cityworks to breach US local governments; Ivanti EPMM flaws hit European, North American and Asian agencies; 184M credentials …
  50. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  51. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  52. Marks & Spencer cyberattack halts online orders, SAP NetWeaver zero-day exploited with web shells, and Craft CMS zero-days hit servers. Plus MTN breach and Salt …