Database/Control plane, storage & DevOps
Ivanti Connect Secure: authentication bypass by spoofing gives unauthenticated remote command execution
Impact
An unauthenticated attacker reaching the gateway can spoof their way past authentication and execute arbitrary commands on the appliance. Connect Secure is frequently the one door into a datacenter's management network, so an appliance under attacker control hands over the path to BMCs, the fabric management plane and the cluster control plane - the networks that are normally defended by being unreachable. CISA lists this as known exploited, which means the window between learning about it and being scanned for it is short. ICS 22.7R2.14 and earlier are stated not to be affected; versions before 25.1.3.0 on the 22.8 line are.
Who can reach it
Anyone who can reach the gateway's web interface, which for a remote-access appliance is normally the public internet. No authentication required, no user interaction.
What to do
Upgrade to ICS 25.1.3.0 or later; this is an appliance upgrade and reboot, so it takes a maintenance window during which remote access is down. Because the CVE is in the known-exploited catalogue, treat any unpatched appliance as possibly already compromised: review integrity checker output and session and admin logs, and rotate credentials and session secrets that transited it rather than only patching.
References
Related entries
- Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
- Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
- NVIDIA AIStore: dSort fetches an attacker-supplied external key map URL (SSRF)CVE-2026-65101 · NVIDIA AIStore (distributed sort, external key map URL)High
- NVIDIA AIStore: experimental HT backend fetches a crafted original URL (SSRF)CVE-2026-65170 · NVIDIA AIStore (experimental HT backend, original URL handling)High
- NVIDIA AIStore: ETL management API missing authorization on job read and start/stopCVE-2026-65172 · NVIDIA AIStore (ETL management API, proxy GET/POST)High
- rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.