8.6
Élevée
Exploitée
CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-290
Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Connect Secure 25.1 | premières → < 25.1.3.0 | 25.1.3.0 |
| Connect Secure 22.8 | premières → < 22.8R2.5 | 22.8R2.5 |
| Connect Secure 22.7 | premières → < 22.7R2.14 | 22.7R2.14 |
Références
- hub.ivanti.com hub.ivanti.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Connect Secure
Les 65 CVE de Connect Secure →
CVE-2026-118527
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
4.3
Moyenne
CVE-2026-111357
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
7.0
Élevée
CVE-2025-55144
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti…
5.4
Moyenne
CVE-2025-55143
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,…
6.1
Moyenne