Threat reportVulnerabilityTL-2026-3651
Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) Espionage
Talos Q3 2026 Vulnerability Pulse (TL-2026-3651), also tracked as Talos Q3 2026 Vulnerability Pulse, is a high-severity software vulnerability scored CVSS 8.6, first published 2026-10-15. It is attributed to UAT-6275 (Kazakhstan) with medium confidence, affects Ivanti Connect Secure, references 4 CVEs (CVE-2026-104935, CVE-2026-102255, CVE-2025-8088), maps to 13 MITRE ATT&CK techniques (T1027, T1053.005, T1059.001), and is covered by 9 detection rules and 19 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 2UAT-6275
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-3651
- Threat ID
- TL-2026-3651
- Also known as
- Talos Q3 2026 Vulnerability Pulse, Break the Silence
- Severity
- HIGH
- CVSS
- 8.6
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UAT-6275, YoroTrooper
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Kazakhstan
- Motivation
- ESPIONAGE
- Target sectors
- government administration, energy, critical-infrastructure, water, technology
- Target regions
- 143 - Central Asia, CIS, 151 - Eastern Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Talos Q3 2026 Vulnerability Pulse
Malware and tooling: Chvost, Laplas (Reverseshell), PickleShell, Ps2exe, PS2EXE
How Talos Q3 2026 Vulnerability Pulse works
Cisco Talos's Q3 2026 newsletter reports CVEs passed 70,000 (+105% YoY) with KEV growth of 37%, and stresses that discovery does not equal exploitation. It highlights actively exploited network-edge flaws, the Ivanti Connect Secure zero-day CVE-2026-104935 and the CVSS 10.0 SonicWall SMA1000 SSRF CVE-2026-102255, plus the Kazakhstan-nexus espionage group UAT-6275 targeting CIS governments via four infection chains.
Cisco Talos's Threat Source newsletter (2026-10-15) summarizes Q3 2026 vulnerability trends: more than 70,000 CVEs recorded by end of September (+105% year over year), KEV additions growing 37% (versus 30% in 2024-2025), roughly one-third of active KEVs dating to 2025 or earlier, and 27% of CVEs affecting networking gear. Per the hunt skeleton's reading of the article, 29% of 2026 CVEs matched their publication and KEV-addition dates. The newsletter points defenders to CISA BOD 26-04 (issued 2026-06-10), which prioritizes remediation by exposure, KEV status, exploit automation and technical impact.
Ivanti Connect Secure (ICS) CVE-2026-104935 is an authentication bypass by spoofing (CWE-290), CVSS 8.6 per Rapid7 (v3.0), that lets a remote unauthenticated attacker execute arbitrary commands. Ivanti disclosed it on 2026-10-13 after limited zero-day exploitation, and CISA added it to KEV the same day. Ivanti had partially patched the issue in July 2026 (25.1.3.0) and was backporting fixes to other supported trains. Volexity reported that actor UTA0576 (low-confidence criminal motive assessment) has chained it since at least 2026-10-03 with two other flaws, culminating in unauthenticated root-level execution on fully patched devices. The command runs as the cgi-server user, and a privilege-escalation flaw remained unpatched at the time of reporting. The chain is re-run per command with no persistent backdoor. Observed post-exploitation includes credential theft from storage, LDAP domain credential extraction, Active Directory enumeration and password spraying. The exploit modifies memory only and restores altered configuration, so Ivanti's Integrity Checker Tool is insufficient.
SonicWall SMA1000 (models 6210, 7210, 8200v) CVE-2026-102255 is a pre-authentication SSRF (CVSS 10.0) in the Workplace interface caused by an unintended alternate access path, allowing the appliance to issue attacker-directed requests to internal functionality. Hotfixes shipped 2026-10-06. Defused saw SSRF traffic against decoys from 2026-10-08 and Previdian reported active exploitation attempts on 2026-10-09. Note: the Talos newsletter as fetched did not name the CVE; the CVE mapping comes from SecurityAffairs/SOCRadar reporting and should be treated as inferred correlation.
UAT-6275 (also tracked as Silent Lynx) is assessed with medium confidence as Kazakhstan-nexus (Russian-language artifacts, UTC+5 working hours, sample submissions from Kazakhstan). Talos and Recorded Future Insikt Group (2026-10-14) document at least eight campaigns from June 2025 to May 2026 against government (diplomacy, economic development, agriculture, environment), water and energy organizations in nine countries. Four infection chains: (A, June 2025) macro-enabled Word documents fetching a second-stage binary; (B, July 2025) PS2EXE-packaged downloaders retrieving reverse shells and creating scheduled tasks; (C, October 2025) malicious shortcuts launching PowerShell to pull GitHub-hosted scripts and later drop PickleShell in the Startup folder; (D, April 2026) RAR archives exploiting WinRAR CVE-2025-8088 to place PickleShell in the Startup folder. Reverse shells are Chvost, Laplas and PickleShell. A FortiWeb PoC for CVE-2025-25257 was recovered from the actor's exposed infrastructure (three open staging directories and a GitHub repository whose commit history exposed development phases). The newsletter lists four SHA256 samples from malware telemetry; their direct linkage to UAT-6275 is not explicit in the fetched text.
MITRE ATT&CK techniques used in TL-2026-3651
Defense Evasion
T1027 Obfuscated Files or Information
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Discovery
Credential Access
T1110.003 Password Spraying; T1555 Credentials from Password Stores
Initial Access
T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in Talos Q3 2026 Vulnerability Pulse
- Ivanti — Connect Secure
Vulnerable versions: 22.8R2.4 and prior; 25.1.1.1 and prior; 25.1.2.2 and prior
Fixed in: 22.8R2.5; 25.1.1.2; 25.1.3.0; 25.1.3.1 - SonicWall — SMA1000 (6210, 7210, 8200v)
Vulnerable versions: 12.4.3-03526 and older; 12.5.0-02952 and older
Fixed in: Hotfix released 2026-10-06 - RARLAB — WinRAR
Vulnerable versions: Versions affected by CVE-2025-8088
Fixed in: Current vendor release
Remediation for Talos Q3 2026 Vulnerability Pulse
Patches
- Ivanti Connect Secure 22.8R2.5, 25.1.1.2, 25.1.3.0, 25.1.3.1
- SonicWall SMA1000 platform hotfix beyond 12.4.3-03526 / 12.5.0-02952
- WinRAR update for CVE-2025-8088
Immediate actions
- Patch Ivanti Connect Secure to 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1 and hunt for compromise after patching (Volexity published IOCs on GitHub)
- Apply the SonicWall SMA1000 hotfix from MySonicWall (SNWLID-2026-0017); no workaround exists
- Hunt for requests to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH headers and for /data/.icscap/
- Block 108.165.147.64 and 146.70.143.142 and review logs for earlier contact
- Reset credentials and review LDAP/AD activity from any potentially exposed Ivanti appliance
Workarounds
- None documented for SonicWall CVE-2026-102255
- Third Ivanti privilege-escalation flaw unpatched at time of reporting; restrict exposure until a fix ships
Longer-term hardening
- Prioritize patching by exposure and KEV status per CISA BOD 26-04
- Reduce internet exposure of VPN/SSL gateway management and Workplace interfaces
- Do not rely on Ivanti Integrity Checker Tool alone; use external/forensic validation
- Disable Office macros from the internet and monitor Startup folder and scheduled task creation
CVEs associated with Talos Q3 2026 Vulnerability Pulse
CVE-2026-104935, CVE-2026-102255, CVE-2025-8088, CVE-2025-25257
Weaknesses (CWE) in Talos Q3 2026 Vulnerability Pulse
Timeline of Talos Q3 2026 Vulnerability Pulse
- Initial Silent Lynx reporting by Seqrite (January 2025; day not stated)
- UAT-6275 Chain A: macro-enabled Word documents download and run a second-stage binary (June 2025; day not stated)
- Chain B: PS2EXE-packaged downloaders fetch reverse shells and create scheduled tasks (July 2025; day not stated)
- Chain C: malicious shortcuts run PowerShell to pull GitHub-hosted scripts; PickleShell later dropped in Startup folder (October 2025; day not stated)
- Chain D: RAR archives exploit WinRAR CVE-2025-8088 to place PickleShell in Startup folder (April 2026; day not stated)
- CISA issues BOD 26-04 on risk-based prioritization of security updates
- Ivanti partially patches the Connect Secure flaw in 25.1.3.0 (July 2026; day not stated)
- UTA0576 begins chaining CVE-2026-104935 with two other flaws for root-level code execution on Ivanti Connect Secure
- SonicWall releases hotfixes for SMA1000 pre-auth SSRF CVE-2026-102255
- Defused detects unauthenticated SSRF traffic against SonicWall SMA decoys
- Previdian announces active exploitation attempts against SMA1000
- Ivanti discloses CVE-2026-104935 as exploited zero-day; CISA adds it to KEV the same day
- Talos and Recorded Future Insikt publish UAT-6275 (Silent Lynx) research
- Talos Q3 2026 Vulnerability Pulse newsletter published
Sources cited for Talos Q3 2026 Vulnerability Pulse
- The Q3 Vulnerability Pulse: Discovery ≠ Exploitation (Talos Threat Source Newsletter)
- Break the Silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) - Rapid7
- Attacker chains three Ivanti Connect Secure flaws - The Hacker News
- Ivanti warns of Connect Secure zero-day exploited in attacks - BleepingComputer
- CISA adds Ivanti Connect Secure flaw to KEV catalog - Security Affairs
- Ivanti security advisory AV26-1035 - Canadian Centre for Cyber Security
- SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin - Security Affairs
- SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances - Security Affairs
- CVE-2026-102255 SonicWall SMA1000 SSRF - SOCRadar
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
Detection coverage for TL-2026-3651
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3651 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.