AX·NEWS
Sign in

Vulnerability

CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

high 8.6 Exploited in the wild 3 stories · 3 outlets

Official record (cve.org)NVDCVE watch

Impacted if

  • Connect Secure < 25.1.1.2 · < 25.1.3.0 · 22.8

Authentication bypass · over the network · no login

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

CISA Known Exploited Vulnerabilities

Added on 2026-10-13, federal remediation due 2026-10-16. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

First seen by AX-NEWS · latest story . Severity: NVD, or the CVE record while the NVD has not scored it. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Coverage

  1. CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
    INThe Hacker News Cybersecurity

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure…

  2. Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
    USCyberScoop Asia Cybersecurity

    Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products. Volexity researchers, which discovered in-the-wild exploitation…

  3. Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
    USSecurityWeek Cybersecurity

    CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on…