Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since today.

No EPSS score available.

Exploitation active

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Ivanti Connect Secure affected
Version Status Constraints
25.1.3.0 unaffected —
25.1.3.1 unaffected —
22.8R2.5 unaffected —
22.7R2.14 unaffected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Ivanti Subscribe
Connect Secure Subscribe

Project Subscriptions

Vendors Products
Ivanti Subscribe
Connect Secure Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935 cve-icon cve-icon
History

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Allowing Remote Code Execution via Spoofing in Ivanti Connect Secure

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Ivanti
Ivanti connect Secure
Vendors & Products Ivanti
Ivanti connect Secure

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

kev

{'dateAdded': '2026-10-13T00:00:00+00:00', 'dueDate': '2026-10-16T00:00:00+00:00'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ivanti

Published:

Updated: 2026-10-13T15:49:48.146Z

Reserved: 2026-10-02T17:07:30.656Z

Link: CVE-2026-104935

cve-icon Vulnrichment

Updated: 2026-10-13T15:41:46.714Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-13T16:17:11.640

Modified: 2026-10-13T17:26:16.840

Link: CVE-2026-104935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:00:17Z

Weaknesses