Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
High 8.6Actively exploited
CVE-2026-104935
Ivanti Connect Secure — Authentication Bypass by Spoofing.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
WeaknessCWE-290: Authentication bypass
Published Updated Source NVD and CISA KEV
CVSS 3.1
8.6
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Exploit chance, 30 days
87%
Higher than 99% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 13 Oct 2026
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Ivanti Connect Secure, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
Timeline · UTC
- Added to CISA KEV
- Published to NVD
- NVD record updated
- CISA remediation deadline
Also actively exploited
Other CVEs in Ivanti Connect Secure
1 more CVE, 1 actively exploited