Ivanti CVE-2026-104935 and BeyondTrust CVE-2026-102764 actively exploited in wild

1. Executive summary

Two authentication bypass flaws in internet-facing access appliances are confirmed exploited: CVE-2026-104935 in Ivanti Connect Secure (CVSS 8.6 HIGH, CWE-290, in CISA KEV since 2026-10-13, EPSS 26%) and CVE-2026-102764 in BeyondTrust Remote Support 26.2.3 and earlier (CVSS 9.3 CRITICAL, CWE-290, in CISA KEV since 2026-10-16, EPSS 1%). Both sit on the perimeter of most EMEA financial estates, and a bypass of this class hands an unauthenticated attacker the same reach as a valid VPN or support session. The same patch cycle carries CVE-2026-96951, an exploited Windows Shell Mark-of-the-Web bypass (CVSS 8.8 HIGH, CWE-77, KEV since 2026-10-13, EPSS 2%), which is the delivery half of the chain: a spoofed appliance session or a crafted message lands a file that Windows no longer flags. BeyondTrust exploitation is attributed to ARMORY CASTLE, a China-linked group, but that attribution is single-sourced and the actor has no MITRE ATT&CK profile, so treat it as unconfirmed.

2. Regulatory framing

3. Technical analysis & attack chain

The two KEV entries are authentication bypasses (CWE-290, authentication bypass by spoofing) in remote-access appliances. The source describes the mechanism at headline level only: CVE-2026-104935 lets a remote attacker execute commands on Ivanti Connect Secure without valid credentials, and CVE-2026-102764 lets an unauthenticated attacker perform unauthorized file operations on BeyondTrust Remote Support 26.2.3 and earlier. Neither source gives the request structure, the spoofed field, or a proof-of-concept. What follows is what is confirmed, then the caveats.

1. The attacker reaches an internet-facing Ivanti Connect Secure appliance and exploits CVE-2026-104935 to run commands without credentials. The source states the flaw is actively exploited and was added to CISA KEV; the KEV entry is dated 2026-10-13.
2. Separately, against BeyondTrust Remote Support 26.2.3 and earlier, the attacker exploits CVE-2026-102764 to perform unauthorized file operations without authentication. KEV entry dated 2026-10-16.
3. For delivery of follow-on payloads to endpoints, CVE-2026-96951 bypasses the Mark of the Web on Windows Shell, so a file arriving by email or instant message no longer carries the unsafe-download warning. Exploitation requires the victim to open the file or click the link.
4. Post-exploitation detail (persistence, C2, lateral movement, exfiltration) is not in the source for either appliance flaw. The advisory does not fill that gap.

On the appliance flaws, the practical consequence is that the authentication control you rely on to segment remote access is the thing being bypassed. An Ivanti Connect Secure box that yields command execution sits at the trust boundary between the internet and the internal network; a BeyondTrust Remote Support appliance that permits unauthenticated file operations sits on the path support staff use to reach managed endpoints. Both are high-value because they are reachable and because they are trusted.

CVE-2026-96951 is a Windows Shell command-injection class flaw (CWE-77) that bypasses MOTW. The source and the corroborating patch coverage agree on the mechanism: a crafted file sent by email or IM, opened by the user, executes without the MOTW warning that would otherwise prompt. It is the weakest link in the chain because it needs user interaction, and the most useful to an attacker who already has a foothold and wants to move a payload onto an analyst or administrator workstation.

Attribution caveat. The source states the China-linked espionage group ARMORY CASTLE exploited CVE-2026-102764 before public disclosure. This is single-sourced (Check Point Research) and ARMORY CASTLE has no MITRE ATT&CK profile, so the attribution is unconfirmed. Do not build detection or blocking on the actor name; build it on the CVE and the appliance telemetry. No actor is named against CVE-2026-104935.

Discrepancy note. The source calls CVE-2026-96951 a Windows Shell vulnerability that "allows attackers to bypass security protections"; the corroborating patch coverage and NVD classify it as CWE-77 command injection with a Mark-of-the-Web bypass. Both describe the same flaw; the verified CWE-77 and CVSS 8.8 are authoritative here.

4. Mitigation & containment

P1 (within 24 hours)

• Patch Ivanti Connect Secure to the vendor build that addresses CVE-2026-104935. The source names the flaw and confirms a fix exists but does not give the fixed version string; obtain it from Ivanti's advisory before closing the ticket. Until then, take internet-facing Connect Secure appliances out of service or restrict them to known source ranges.
• Patch BeyondTrust Remote Support to a version later than 26.2.3. The source gives 26.2.3 and earlier as affected and states BeyondTrust has addressed it; confirm the fixed build on BeyondTrust's advisory.
• Hunt appliance logs for unauthenticated command execution or file operations on Ivanti Connect Secure and BeyondTrust Remote Support in the window since 2026-10-13. On Ivanti, look for command execution by sessions with no preceding successful authentication. On BeyondTrust, look for file operations from unauthenticated sessions.
• Apply the October 2026 Microsoft updates carrying the CVE-2026-96951 fix to all Windows endpoints, prioritising administrator and support workstations.

P2 (within 72 hours)

• Enforce MOTW where you can: confirm Attachment Manager and SmartScreen policy are on, and block executable attachments at the mail gateway so the CVE-2026-96951 user-interaction step has nothing to open.
• Review every MSP or third-party that operates a BeyondTrust or Ivanti appliance on your behalf and obtain written confirmation of patch state. The ConnectWise Cloud Backup credential compromise in the same report (173 organisations reached via compromised application credentials) is a reminder that the access path, not just the appliance, is the exposure.
• Rotate credentials and session tokens issued through any appliance that was reachable and unpatched during the exploitation window.

P3 (within 7 days)

• Add the two KEV CVEs to your vulnerability management exception process so they cannot be deferred, and reconcile your asset inventory against internet-facing instances of both products.
• Tabletop the DORA Art. 19 reporting path for a perimeter-appliance bypass so the clock is understood before the next one.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths) are present in the source material for CVE-2026-104935, CVE-2026-102764 or CVE-2026-96951. The sources describe the vulnerabilities and confirm exploitation but publish no artefacts.

Behavioural indicators

6. Detection

The sources give no file artefacts, command-line flags, mutexes or registry keys for the appliance flaws, so no YARA rule is emitted for them; a rule built on CVE identifiers or product names would detect reporting, not the threat. The Sigma rule below targets the observable behaviour of an unauthenticated session performing privileged actions on the two appliance classes and should be tuned to your log schema.

title: Unauthenticated privileged action on Ivanti Connect Secure or BeyondTrust Remote Support
id: 8f3c2a10-6b7e-4d21-9a55-0c1e7d4b2f90
status: experimental
author: Adverse Trace
date: 2026-10-19
references:

  - https://research.checkpoint.com/2026/19th-october-threat-intelligence-report/
description: Flags command execution or file operations on perimeter access appliances where no successful authentication precedes the action, consistent with CVE-2026-104935 and CVE-2026-102764.
logsource:
  product: ivanti
  service: connect_secure
detection:
  selection_action:
    event_type:

      - command_execution
      - file_operation
  selection_noauth:
    auth_result: failure
  condition: selection_action and selection_noauth
falsepositives:

  - Health checks or monitoring probes that trigger file operations without authenticating
level: high

For BeyondTrust, mirror the rule with product: beyondtrust and service: remote_support, keying on file_operation events with no preceding authenticated session. Both rules are behavioural and will need field mapping to your appliance log export before deployment.

CVE assessment

7 referenced CVEs — 4 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• Check Point Research, "19th October – Threat Intelligence Report", 2026-10-19. https://research.checkpoint.com/2026/19th-october-threat-intelligence-report/
• SANS Internet Storm Center, "October 2026 Microsoft Patch Tuesday", 2026-10-13. https://isc.sans.edu/diary/rss/33422
• Cisco Talos, "Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities". https://blog.talosintelligence.com/microsoft-patch-tuesday-for-october-2026/
• Malwarebytes Labs, "Update Windows: Record Patch Tuesday fixes flaw already under attack". https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack

8. Adverse Trace position

Adverse Trace assesses CVE-2026-104935 and CVE-2026-102764 as the priority items in this cycle: both are confirmed exploited, both are in CISA KEV, and both sit on perimeter appliances that EMEA financial clients expose to the internet. The EPSS gap (26% for the Ivanti flaw against 1% for BeyondTrust) reflects observed exploitation volume, not impact; the BeyondTrust flaw is the higher CVSS and the one with a named, if unconfirmed, espionage actor behind it. The ARMORY CASTLE attribution is single-sourced and unprofiled in MITRE ATT&CK, so we treat it as unconfirmed and will not build client guidance on the actor name. We will obtain the fixed version strings from the Ivanti and BeyondTrust advisories and issue a follow-up when they are confirmed, and we will re-check KEV status and EPSS for both CVEs over the next 72 hours. Clients who cannot confirm patch state on an internet-facing instance of either product should treat the appliance as compromised and isolate it today.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.