MSRXMSRXSecurity
Vulnerabilities / CVE-2026-104935

CVE-2026-104935

Published 2026-10-13 · Analyzed

CVE-2026-104935

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-13, with a fix-by date of 2026-10-16. Patch it first.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

8.6 HIGH
CVSS 3.1 · CNA
87%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Scores

8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LCNA

Affected products

  • ivanti connect secure: ≥ 25.1.0.0, < 25.1.1.2; ≥ 25.1.2.0, < 25.1.3.0; 22.8 r2; 22.8 r2.1; 22.8 r2.2; 22.8 r2.3; 22.8 r2.4

Weakness: CWE-290

2 references (advisories, patches, write-ups)

Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVECheck your dependenciesScan a website