Authentication Bypass Vulnerability in Ivanti Connect Secure
CVE-2026-104935

8.6HIGH

Key Information:

Vendor

Ivanti
Status
Connect Secure
Vendor
CVE Published:
13 October 2026

Badges

📈 Trended📈 Score: 5,350💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 88%🦅 CISA Reported📰 News Worthy

What is CVE-2026-104935?

CVE-2026-104935 is a serious vulnerability found in Ivanti Connect Secure, a product designed for secure remote access to corporate networks. Specifically, this authentication bypass vulnerability allows remote unauthenticated attackers to exploit the system by spoofing authentication mechanisms. The risk associated with this vulnerability is particularly concerning as it enables unauthorized individuals to execute arbitrary commands on the affected system, potentially compromising sensitive data and undermining the integrity of the network infrastructure. Affected versions include Ivanti Connect Secure before 25.1.3.0, while version 22.7R2.14 and prior are not impacted, suggesting that organizations using affected versions should prioritize patching to mitigate the risks involved.

Potential Impact of CVE-2026-104935

  1. Unauthorized Access: The vulnerability permits attackers to bypass authentication controls, enabling them to gain unauthorized access to restricted systems and data. This poses direct threats to sensitive organizational information and can lead to data breaches.

  2. Arbitrary Command Execution: With the ability to execute arbitrary commands, attackers could manipulate the system to perform malicious actions, leading to complete control over the vulnerable environment. This could facilitate further exploits or enable attackers to plant malware within the infrastructure.

  3. Increased Risk of Exploitation: Although no known exploitations in the wild have been reported so far, the nature of the vulnerability makes it attractive to cybercriminals, especially those in ransomware groups. The potential for such exploitation raises significant concerns for organizations concerning overall network security and resilience against future threats.

CISA has reported CVE-2026-104935

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-104935 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Connect Secure 25.1.3.0

Connect Secure 25.1.3.0

Connect Secure 25.1.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104935
Created by maxprog-svg

News Articles

favicon imageBleepingComputer

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.

3 days ago

favicon imageThe Hacker News

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

CISA adds two exploited Ivanti Connect Secure flaws to its KEV catalog after attackers chained them to gain unauthenticated root-level code execution.

5 days ago

favicon imageIt Security News

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) - IT Security News

Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has...

3 weeks ago

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti...

EPSS Score

88% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by Securityweek

  • Vulnerability published

  • Vulnerability Reserved

.