CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
What it is
You should be aware that a vulnerability in Ivanti Connect Secure could allow a remote attacker to bypass authentication and execute arbitrary commands, potentially leading to significant disruption of your business operations. You should update Ivanti Connect Secure to the vendor's fixed version as soon as possible to prevent exploitation of this vulnerability.
CISA: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
What to do
Treat this as urgent. Identify every affected system, starting with anything internet-facing, and apply the vendor fix or mitigation within days. If you cannot patch quickly, isolate or disable the affected service and watch for signs of compromise.
- Priority
- Act now: Patch or mitigate internet-facing systems within days.
- Severity (CVSS)
- 8.6 high
- CISA assessment (SSVC)
- actively exploited; attackers can automate it at scale; total control of the affected system
- Exploit probability (EPSS, 30 days)
- —
- Added to CISA KEV
- 13 October 2026
- CISA fix-by date
- 16 October 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-290
References
- NIST NVD entry
- CISA KEV entry
- hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.