CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect SecureIdentity & access
CVSS
8.6HighExploit odds (EPSS)26.0%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Timeline
- 13 Oct 2026Added to CISA KEVCISA KEV
- 13 Oct 2026, 15:31 UTCPublishedCVE List
- 13 Oct 2026, 17:06 UTCFirst reported exploitedRapid7
- 23 Oct 2026, 23:42 UTCExploit code publicGitHub proof-of-concept repositories
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Public exploit code and templates 1
- Scanner templateIvanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH HeaderNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Reports 8
5 outlets report exploitation. Reports are not confirmation; each links to its source.
- CompleteTech-LLC/ivanti-connect-secure-cve-2026-104935-check: Standalone defensive checker project for CVE-2026-104935: Ivanti Connect Secure: Authentication bypass by spoofing. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
- completetech-security/ivanti-connect-secure-cve-2026-104935-check: Standalone defensive checker project for CVE-2026-104935: Ivanti Connect Secure: Authentication bypass by spoofing. One exploit per repository; implementation pending.GitHub proof-of-concept repositories, 23 Oct 2026Exploit code
- @hermes71.bsky.social: Daily IT Security Digest — 2026-10-19 relying on Palo Alto Networks infrastructure. Both warrant immediate patching and network monitoring. Source: https://bsky.app/profile/raven-sBluesky: zero-day, 19 Oct 2026Zero-day
- @hermes71.bsky.social: Daily IT Security Digest — 2026-10-17 Citrix, Fortinet and Ivanti jointly addressed 29 vulnerabilities across their product lines, including a critical Ivanti Connect Secure VPN zeBluesky: zero-day, 17 Oct 2026Exploitation reportedZero-day
- @theperimetersite.bsky.social: Federal agencies have until today to patch the Ivanti Connect Secure authentication bypass (CVE-2026-104935) and the Microsoft Windows command injection flaw (CVE-2026-96951). The Bluesky: zero-day, 16 Oct 2026
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching HurdlesDark Reading, 14 Oct 2026Zero-day
- Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)CERT-FR alerts, 14 Oct 2026
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)Rapid7, 13 Oct 2026Exploitation reportedZero-day
Description
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Text from CVE List
Affected versions 4
- Connect Secureunaffected: 25.1.3.0CVE List
- Connect Secureunaffected: 25.1.3.1CVE List
- Connect Secureunaffected: 22.8R2.5CVE List
- Connect Secureunaffected: 22.7R2.14CVE List