8.6
High
Exploited
CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-290
Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Connect Secure 25.1 | earliest → < 25.1.3.0 | 25.1.3.0 |
| Connect Secure 22.8 | earliest → < 22.8R2.5 | 22.8R2.5 |
| Connect Secure 22.7 | earliest → < 22.7R2.14 | 22.7R2.14 |
References
- hub.ivanti.com hub.ivanti.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Connect Secure
The 65 CVEs of Connect Secure →
CVE-2026-118527
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
4.3
Medium
CVE-2026-111357
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
7.0
High
CVE-2025-55144
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti…
5.4
Medium
CVE-2025-55143
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,…
6.1
Medium