Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-104935

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

8.6
CVSS 3.1
1
story
OCT 13
added to KEV
Severity
8.6 High · vendor score
Vendor
Ivanti
Product
Connect Secure
Published
Oct 13, 2026
Added to KEV
Oct 13, 2026
KEV deadline
Oct 16, 2026
Ransomware use
Unknown
Weakness
CWE-290

What it is

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesIvanti Connect Secure Zero-Day Exploited in AttacksIvanti warns of active exploitation of CVE-2026-104935, a high-severity Connect Secure flaw.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryhub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935