{"id":6129,"date":"2026-10-13T14:26:00","date_gmt":"2026-10-13T19:26:00","guid":{"rendered":"https:\/\/cert.pa\/?p=6129"},"modified":"2026-10-13T14:26:01","modified_gmt":"2026-10-13T19:26:01","slug":"csirt-panama-aviso-2026-oct-13-vulnerabilidad-alta-explotada-activamente-en-ivanti-connect-secure-que-permite-ejecutar-comandos-sin-autenticacion-cve-2026-104935","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=6129","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2026-oct-13: Vulnerabilidad Alta explotada activamente en Ivanti Connect Secure que permite ejecutar comandos sin autenticaci\u00f3n \u2014 CVE-2026-104935"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Fecha de emisi\u00f3n:<\/strong> 13 de octubre de 2026<br><strong>CVE ID:<\/strong> CVE-2026-104935<br><strong>Severidad:<\/strong> ALTA \u2014 CVSS 3.1: 8.6 (prioridad cr\u00edtica por explotaci\u00f3n activa)<br><strong>Vector CVSS:<\/strong> CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:L\/A:L<br><strong>Tipo de vulnerabilidad:<\/strong> CWE-290: Omisi\u00f3n de autenticaci\u00f3n mediante suplantaci\u00f3n (spoofing)<br><strong>Producto afectado:<\/strong> Ivanti Connect Secure (ICS)<br><strong>Explotaci\u00f3n activa:<\/strong> S\u00ed \u2014 Confirmada por Ivanti en un n\u00famero limitado de clientes; incluida en el cat\u00e1logo CISA KEV desde el 13 de octubre de 2026 (fecha l\u00edmite federal: 16 de octubre de 2026)<br><strong>Fuente:<\/strong> Ivanti \/ NVD \/ CISA \/ Volexity<br><strong>Clasificaci\u00f3n TLP:<\/strong> TLP:CLEAR (Difusi\u00f3n p\u00fablica)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>I. Descripci\u00f3n<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Se ha identificado una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n mediante suplantaci\u00f3n en Ivanti Connect Secure, registrada como CVE-2026-104935 y calificada con 8.6 de 10 en la escala CVSS 3.1. Un atacante remoto, sin necesidad de credenciales, podr\u00eda aprovecharla para ejecutar comandos arbitrarios en el equipo VPN.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ivanti confirm\u00f3 que la vulnerabilidad ha sido explotada contra un n\u00famero limitado de clientes al momento de su divulgaci\u00f3n. La firma Volexity, que colabor\u00f3 en el hallazgo, document\u00f3 su uso encadenado con otros fallos de d\u00eda cero. El 13 de octubre de 2026, la Agencia de Ciberseguridad y Seguridad de Infraestructura de Estados Unidos (CISA) la incorpor\u00f3 a su cat\u00e1logo de Known Exploited Vulnerabilities (KEV).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Descripci\u00f3n t\u00e9cnica publicada en NVD (en ingl\u00e9s): \u00abAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\u00bb<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>II. Productos Afectados<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Producto<\/th><th>Versiones afectadas<\/th><th>Versi\u00f3n corregida<\/th><\/tr><\/thead><tbody><tr><td>Ivanti Connect Secure 25.1.x (ISA6000\/ISA8000)<\/td><td>25.1.1.1 y anteriores<\/td><td>25.1.1.2<\/td><\/tr><tr><td>Ivanti Connect Secure 25.1.x<\/td><td>25.1.2.2 y anteriores<\/td><td>25.1.3.0 \/ 25.1.3.1 (requiere plataforma ISA4500, ISA6500 o ISA8500)<\/td><\/tr><tr><td>Ivanti Connect Secure 22.8<\/td><td>22.8R2.4 y anteriores<\/td><td>22.8R2.5<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">No afectadas: 22.7R2.14 y anteriores, 25.1.3.0 y posteriores.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>III. Acciones Requeridas<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Actualizar inmediatamente<\/strong><br>Instalar la versi\u00f3n corregida correspondiente, disponible en el Ivanti License System (ILS). Para la rama 22.8, Ivanti recomienda migrar a 25.1.1.2 o, si no es posible de inmediato, aplicar 22.8R2.5. Las ramas 22.7 y 22.8 llegan al fin de soporte el 31 de enero de 2027, por lo que conviene planificar la migraci\u00f3n a 25.1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Mitigar inmediatamente si no es posible parchear<\/strong><br>Restringir el acceso a la interfaz de administraci\u00f3n del equipo VPN desde Internet y limitarlo a direcciones de confianza, y seguir las indicaciones del fabricante.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Verificar posible compromiso<\/strong><br>El parche cierra el vector de explotaci\u00f3n, pero no elimina un acceso que el atacante ya haya obtenido. Ejecutar la herramienta Integrity Checker Tool (ICT) de Ivanti, revisar los indicadores de compromiso publicados por Volexity y, si hay se\u00f1ales de intrusi\u00f3n, seguir los pasos de recuperaci\u00f3n de Ivanti. Reportar cualquier hallazgo a incidentes@cert.pa.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>IV. Referencias<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ivanti. Security Advisory Ivanti Connect Secure (CVE-2026-104935). <a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935\">https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935<\/a><\/li>\n\n\n\n<li>Ivanti. Ivanti Connect Secure 22.8x and 25x Recovery Steps. <a href=\"https:\/\/forums.ivanti.com\/s\/article\/Ivanti-Connect-Secure-22-8x-and-25x-Recovery-Steps\">https:\/\/forums.ivanti.com\/s\/article\/Ivanti-Connect-Secure-22-8x-and-25x-Recovery-Steps<\/a><\/li>\n\n\n\n<li>Volexity. A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days. <a href=\"https:\/\/www.volexity.com\/blog\/2026\/10\/13\/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\/\">https:\/\/www.volexity.com\/blog\/2026\/10\/13\/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\/<\/a><\/li>\n\n\n\n<li>National Institute of Standards and Technology (NIST). National Vulnerability Database: CVE-2026-104935. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-104935\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-104935<\/a><\/li>\n\n\n\n<li>CISA. Known Exploited Vulnerabilities Catalog. <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\">https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog<\/a><\/li>\n\n\n\n<li>SecurityWeek. Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN. <a href=\"https:\/\/www.securityweek.com\/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn\/\">https:\/\/www.securityweek.com\/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn\/<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>V. Informaci\u00f3n de Contacto<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CSIRT PANAM\u00c1 \u00b7 Computer Security Incident Response Team<br>Autoridad Nacional para la Innovaci\u00f3n Gubernamental<br>E-Mail: incidentes@cert.pa \u00b7 info@cert.pa<br>Phone: +507 520-CERT (2378) \u00b7 Web: https:\/\/cert.pa \u00b7 X: @CSIRTPanama \u00b7 Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fecha de emisi\u00f3n: 13 de octubre de 2026CVE ID: CVE-2026-104935Severidad: ALTA \u2014 CVSS 3.1: 8.6 (prioridad cr\u00edtica por explotaci\u00f3n activa)Vector [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":6133,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[76,72,291,68,221],"class_list":["post-6129","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-actualizaciones","tag-avisos-de-seguridad","tag-ivanti","tag-vulnerabilidades","tag-zero-day-2","severidad-alto"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6129","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6129"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6129\/revisions"}],"predecessor-version":[{"id":6131,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6129\/revisions\/6131"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/6133"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6129"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6129"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}