· CVE-2026-104935

Ivanti Connect Secure Authentication bypass (spoofing)

8.6 CVSS · highExploited

Authentication bypass (spoofing) in Ivanti Connect Secure. Exploitable over the network, without logging in, without any user action. CVSS 8.6 (high). According to CISA it is already being exploited. Fixed in 25.1.1.2 and 25.1.3.0.

Vendor security page

ivanti.com · The vendor’s information prevails.

At a glance

CVE
CVE-2026-104935
Product
Ivanti Connect Secure
Vendor
Ivanti
Affected versions
  • ≥ 25.1.0.0, < 25.1.1.2
  • ≥ 25.1.2.0, < 25.1.3.0
  • 22.8-r2
  • 22.8-r2.1
  • 22.8-r2.2
  • 22.8-r2.3
  • 22.8-r2.4
per NVD
Fixed in
25.1.1.2, 25.1.3.0
CVSS
8.6 (high)
CVSS 3.1, scored by the CVE issuer
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Known exploited
Yes, per CISA (in the KEV catalog since 13 October 2026)
Weakness type
CWE-290 (Authentication bypass (spoofing))
Published
Last modified

What to do

  1. Update to a fixed version: 25.1.1.2 and 25.1.3.0 or later, depending on the release line you run.
  2. Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
  3. Since it is already exploited: after updating, check whether the system was compromised before.
  4. Also check test, staging and forgotten installations of the same software.
Vendor security page ↗

Original description

From the CVE record. The summary above is built from the structured data.

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Name at CISA: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Official references

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 2 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free