CVE-2026-104935
Authentication bypass allows remote command execution in Ivanti Connect Secure.
An authentication bypass vulnerability in Ivanti Connect Secure before version 25.1.3.0 lets an unauthenticated attacker remotely execute arbitrary commands. Versions 22.7R2.14 and prior are not affected. CISA has added this flaw to its known-exploited list, meaning attackers are using it, and the agency orders federal agencies to patch by October 16, 2026.
Ivanti Connect Secure · Updated 2 Nov · From 3 of our stories and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 13 Oct; US agencies must fix by 16 Oct
SeverityhighCVSS 8.6 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Update Ivanti Connect Secure to version 25.1.3.0 or later, as Ivanti has released software updates to patch this vulnerability.
- If you cannot patch immediately, follow Ivanti's advisory for workarounds.
- Monitor for signs of lateral movement, as researchers report attackers are stealing credentials and tampering with logs.
- Check CISA's known-exploited list for updates and apply any additional mitigations they recommend.
What happened
- 1 OctAttackers have been chaining this vulnerability in attacks since at least October 1.
- 13 OctCISA adds the vulnerability to its known-exploited list and orders federal agencies to patch by October 16.
- 13 OctIvanti releases software updates to patch two of three vulnerabilities in the attack chain.
- 14 OctCISA orders urgent patching of the actively exploited zero-day vulnerability.
- 28 OctAn InfraTrust report warns of exploited flaws in critical network infrastructure.
- 2 NovIvanti patches two more Connect Secure zero-days exploited since October.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | high 8.6 | 13 Oct | 87% |
Our reporting
2 NovIvanti patches two more Connect Secure zero-days exploited since October14 OctCISA orders urgent patching of Ivanti vulnerability under active zero-day attack13 OctIvanti zero-day attackers were preparing for lateral movement, researchers warnReported elsewhere
Rapid7 · 2 NovAdditional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) ↗BleepingComputer · 2 NovIvanti patches two more Connect Secure zero-days chained in attacks ↗BleepingComputer · 28 OctInfraTrust report warns of exploited flaws in critical network infrastructure ↗The records
CISA known-exploited catalog ↗CVE-2026-104935 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free