# Talos Q3 2026 Vulnerability Pulse: Ivanti Connect Secure Zero-Day CVE-2026-104935, SonicWall SMA1000 SSRF CVE-2026-102255, and UAT-6275 (Silent Lynx) Espionage

> Cisco Talos's Q3 2026 newsletter reports CVEs passed 70,000 (+105% YoY) with KEV growth of 37%, and stresses that discovery does not equal exploitation. It highlights actively exploited network-edge flaws, the Ivanti Connect Secure zero-day CVE-2026-104935 and the CVSS 10.0 SonicWall SMA1000 SSRF CVE-2026-102255, plus the Kazakhstan-nexus espionage group UAT-6275 targeting CIS governments via four infection chains.

- **Published:** 2026-10-15T18:23:52Z
- **Last reviewed:** 2026-10-15T18:23:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3651
- **ID:** TL-2026-3651
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UAT-6275 (Kazakhstan)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-104935, CVE-2026-102255, CVE-2025-8088, CVE-2025-25257

## Description

Cisco Talos's Threat Source newsletter (2026-10-15) summarizes Q3 2026 vulnerability trends: more than 70,000 CVEs recorded by end of September (+105% year over year), KEV additions growing 37% (versus 30% in 2024-2025), roughly one-third of active KEVs dating to 2025 or earlier, and 27% of CVEs affecting networking gear. Per the hunt skeleton's reading of the article, 29% of 2026 CVEs matched their publication and KEV-addition dates. The newsletter points defenders to CISA BOD 26-04 (issued 2026-06-10), which prioritizes remediation by exposure, KEV status, exploit automation and technical impact.

Ivanti Connect Secure (ICS) CVE-2026-104935 is an authentication bypass by spoofing (CWE-290), CVSS 8.6 per Rapid7 (v3.0), that lets a remote unauthenticated attacker execute arbitrary commands. Ivanti disclosed it on 2026-10-13 after limited zero-day exploitation, and CISA added it to KEV the same day. Ivanti had partially patched the issue in July 2026 (25.1.3.0) and was backporting fixes to other supported trains. Volexity reported that actor UTA0576 (low-confidence criminal motive assessment) has chained it since at least 2026-10-03 with two other flaws, culminating in unauthenticated root-level execution on fully patched devices. The command runs as the cgi-server user, and a privilege-escalation flaw remained unpatched at the time of reporting. The chain is re-run per command with no persistent backdoor. Observed post-exploitation includes credential theft from storage, LDAP domain credential extraction, Active Directory enumeration and password spraying. The exploit modifies memory only and restores altered configuration, so Ivanti's Integrity Checker Tool is insufficient.

SonicWall SMA1000 (models 6210, 7210, 8200v) CVE-2026-102255 is a pre-authentication SSRF (CVSS 10.0) in the Workplace interface caused by an unintended alternate access path, allowing the appliance to issue attacker-directed requests to internal functionality. Hotfixes shipped 2026-10-06. Defused saw SSRF traffic against decoys from 2026-10-08 and Previdian reported active exploitation attempts on 2026-10-09. Note: the Talos newsletter as fetched did not name the CVE; the CVE mapping comes from SecurityAffairs/SOCRadar reporting and should be treated as inferred correlation.

UAT-6275 (also tracked as Silent Lynx) is assessed with medium confidence as Kazakhstan-nexus (Russian-language artifacts, UTC+5 working hours, sample submissions from Kazakhstan). Talos and Recorded Future Insikt Group (2026-10-14) document at least eight campaigns from June 2025 to May 2026 against government (diplomacy, economic development, agriculture, environment), water and energy organizations in nine countries. Four infection chains: (A, June 2025) macro-enabled Word documents fetching a second-stage binary; (B, July 2025) PS2EXE-packaged downloaders retrieving reverse shells and creating scheduled tasks; (C, October 2025) malicious shortcuts launching PowerShell to pull GitHub-hosted scripts and later drop PickleShell in the Startup folder; (D, April 2026) RAR archives exploiting WinRAR CVE-2025-8088 to place PickleShell in the Startup folder. Reverse shells are Chvost, Laplas and PickleShell. A FortiWeb PoC for CVE-2025-25257 was recovered from the actor's exposed infrastructure (three open staging directories and a GitHub repository whose commit history exposed development phases). The newsletter lists four SHA256 samples from malware telemetry; their direct linkage to UAT-6275 is not explicit in the fetched text.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1203 Exploitation for Client Execution
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1110.003 Password Spraying
- T1555 Credentials from Password Stores
- T1087.002 Domain Account
- T1608.001 Upload Malware

## Sources

- [The Q3 Vulnerability Pulse: Discovery ≠ Exploitation (Talos Threat Source Newsletter)](https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/)
- [Break the Silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations](https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations)
- [Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) - Rapid7](https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935/)
- [Attacker chains three Ivanti Connect Secure flaws - The Hacker News](https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html)
- [Ivanti warns of Connect Secure zero-day exploited in attacks - BleepingComputer](https://bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks)
- [CISA adds Ivanti Connect Secure flaw to KEV catalog - Security Affairs](https://securityaffairs.com/?p=200887)
- [Ivanti security advisory AV26-1035 - Canadian Centre for Cyber Security](https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035)
- [SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin - Security Affairs](https://securityaffairs.com/?p=200816)
- [SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances - Security Affairs](https://securityaffairs.com/?p=200569)
- [CVE-2026-102255 SonicWall SMA1000 SSRF - SOCRadar](https://socradar.io/blog/cve-2026-102255-sonicwall-sma1000-ssrf/)
- [CISA BOD 26-04: Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3651