CVE-2026-104935 Exploited in the wild
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- Risk score
- 100/100
- CVSS
- 8.6 v3.1
- Exploit chance (30 days)
- 86.8%
- Published
- 13 Oct 2026
- Added to CISA's exploited list
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Ivanti Connect Secure has a vulnerability (CVE-2026-104935) that allows a remote attacker to execute arbitrary commands without authentication. This could lead to a high impact on confidentiality, integrity, and availability.
- Affected
- {'products': ['Ivanti Connect Secure'], 'packages': [], 'versions': ['before 25.1.3.0']}
- Fix
- Upgrade Ivanti Connect Secure to 25.1.3.0 or later.
- Exploitation
- Exploited in the wild
Story map
At a glance
Ivanti Connect Secure: Red, act today. Ivanti Connect Secure has a vulnerability (CVE-2026-104935) that allows a remote attacker to execute arbitrary commands without authentication. This could lead to a high impact on confidentiality, integrity, and availability.
The flaws
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVSS 8.6 · EPSS 87% · exploited)
The fix
Upgrade Ivanti Connect Secure: 25.1.3.0 or later on your release line
Who is exposed: {'products': ['Ivanti Connect Secure'], 'packages': [], 'versions': ['before 25.1.3.0']}
Where it stands
- Exploited in the wild
- On CISA's exploited list since 13 Oct
- US federal deadline 16 Oct
- 1 outlet covering it
How it unfolded
- 13 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
- 14 Oct, Dark Reading (press): Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
- 16 Oct, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: CWE-290 (CWE-290). 54 other warnings in 30 days
In the news
TL;DR
Ivanti Connect Secure has a high-severity authentication bypass vulnerability (CVE-2026-104935) that allows remote attackers to execute arbitrary commands.
- The vulnerability affects ICS version 25.1.3.0 and earlier, but not version 22.7R2.14 or prior.
- SecurityWeek reports that the vulnerability was partially discovered and patched in July, leaving room for exploitation.
- The vulnerability is remotely exploitable without logging in and is considered high-severity with a CVSS score of 8.6.
- CISA has marked the vulnerability as exploited in the wild.
AI summary of 1 article.
Why it is Red
- CVSS 8.6 high
- Exploitation likely: EPSS 86.8% (top 1%)
- Exploited in the wild (CISA KEV)
- Remotely exploitable without logging in
- On your watchlist: ivanti
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
References
Original description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Last activity 13 Oct 2026. Patch Forecast updates every hour.