CVSSv3.0

Ivanti Connect Secure VPN Hit by Zero-Day Authentication Bypass Vulnerability CVE-2026-104935

Ivanti has disclosed a critical authentication bypass vulnerability in its Ivanti Connect Secure remote access product that allows remote attackers to execute arbitrary commands without authentication. The flaw, tracked as CVE-2026-104935, carries a CVSSv3.0 base score of 8.6 and has already been exploited in the wild against certain customer environments. Affected versions include 25.1.2.2, 25.1.1.1, and 22.8R2.4 along with earlier releases in those branches, while versions 22.7R2.14 and prior remain unaffected. Ivanti discovered the issue through its product security program and released the fix in version 25.1.3.0 during July. The company published its security advisory on October 13, 2026, confirming active exploitation of the zero-day in unpatched branches.

WordPress 7.0.4 Released to Patch High-Severity RCE Vulnerability CVE-2026-65640

The WordPress development team has issued version 7.0.4 to address a remote code execution vulnerability tracked as CVE-2026-65640. The flaw affects installations that use the Imagick and Ghostscript image-processing components and grants code execution to users with Author privileges or higher. An attacker can upload a specially crafted PostScript file to trigger arbitrary code execution on the server. The vulnerability received a CVSS v3.0 base score of 8.8 and is rated High severity. Administrators are urged to update immediately, either manually through the dashboard or via automatic background updates. Backported fixes for the 4.7 branch are also in preparation and will be released soon.