CVE-2026-104935: Ivanti Connect Secure

What is CVE-2026-104935?

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CVSS8.6 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CWECWE-290

NVD published2026-10-13

NVD last modified2026-10-13

Timeline

2026-10-13Published to the U.S. National Vulnerability Database (NVD)
2026-10-13Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-10-14First covered in a defend.network daily briefing
2026-10-16CISA federal remediation deadline (BOD 22-01)

CISA Known Exploited Vulnerability

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Added to KEV2026-10-13

Federal patch deadline2026-10-16

Known ransomware useUnknown

Affected product

Ivanti Connect Secure

Remediation Steps

Apply the vendor security patch from Ivanti immediately
If patching is not immediately possible, restrict network access to Ivanti Connect Secure to trusted networks only
Monitor for unauthorized access attempts and anomalous VPN session activity
Verify patch installation and confirm no suspicious sessions remain active

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of October 2026 (October 12 – 18)
Microsoft 1,411-flaw Patch Tuesday; Ivanti zero-day root access; OpenAI spy device arrest (2026-10-14)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.