CVE-2026-104935

Published: Oct 13, 2026Modified: Oct 13, 2026CISA KEV

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Exploitability: 3.9 / Impact: 4.7

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Affected (7)

Products: Ivanti: Connect Secure

Ivanti

1 product

Connect Secure

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	25.1.0.0 ≤ version < 25.1.1.2
Ivanti Connect Secure	25.1.2.0 ≤ version < 25.1.3.0
Ivanti Connect Secure	Version 22.8 r2.1
Ivanti Connect Secure	Version 22.8 r2.2
Ivanti Connect Secure	Version 22.8 r2.3
Ivanti Connect Secure	Version 22.8 r2.4
Ivanti Connect Secure	Version 22.8 r2

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (2)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.