CISA adds Ivanti Connect Secure auth bypass to KEV (CVE-2026-104935)
Original title: CISA KEV: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability — Ivanti Connect Secure (CVE-2026-104935)
Unauthenticated attackers can run commands on ICS before 25.1.3.0; the federal due date is October 16.
CISA added CVE-2026-104935, an authentication-bypass-by-spoofing flaw in Ivanti Connect Secure, to the Known Exploited Vulnerabilities catalog. ICS before 25.1.3.0 lets a remote unauthenticated attacker execute arbitrary commands. Version 22.7R2.14 and prior are not affected. Stakeholders must apply vendor mitigations under BOD 26-04 by October 16, 2026, or stop using the product if mitigations are unavailable.
Unconfirmed: CISA lists known ransomware campaign use as unknown.
- Affected builds are ICS before 25.1.3.0.
- ICS 22.7R2.14 and earlier are not impacted.
- CISA due date is October 16, 2026.
- Known ransomware campaign use is listed as unknown.
Impact: unauthenticated remote arbitrary command execution
| Product | Affected |
|---|---|
| Ivanti Connect Secure | before 25.1.3.0; not 22.7R2.14 or prior |
- 1.Apply vendor mitigations and follow CISA BOD 26-04 by October 16, 2026.
- 2.Discontinue use if mitigations are unavailable.
- 3.Evaluate each asset's internet exposure against BOD 26-04.
- CVEs
- CVE-2026-104935
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
From the original article
1 min read at cisa.govAuthentication bypass by spoofing in ICS before version 25. 1. 3.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.