CVE WatchOct 13, 2026

CVE-2026-104935

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVSS

8.6

High

EPSS

—

KEV

YES

Oct 13, 2026

Exploit Today

0-100

Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-290

EPSS · 30d

Not enough EPSS history yet.

KEV catalog record

Product

Ivanti / Connect Secure

Vulnerability

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Added to KEV

Oct 13, 2026

Remediate by

Oct 16, 2026

Known ransomware use

Summary description

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Notes

https:/forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 ; https://nvd.nist.gov/vuln/detail/CVE-2026-104935

Technical description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-84790—

—

——0OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field9h CVE-2026-838645.5 MED

—

——0Improper access control in Windows NTFS allows an authorized attacker to disclose information locally.10h CVE-2026-838458.4 HIG

—

——0Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally.8h CVE-2026-75120—

—

——0The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™ Information Assurance, and OpenText™ Endpoint Security contains a security vulnerability on the Agents that could allow unauthorized or unauthenticated activity that establishes an unauthorized connection to a vulnerable Agent by bypassing intended security controls during session establishment11h CVE-2026-701797.5 HIG

—

——0Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.10h CVE-2026-1081317.5 HIG

—

——0No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.11h