CVE-2026-104935
published 2026-10-13CVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
PriorityP197high8.6CVSS 3.1
AVNACLPRNUINSUCHILAL
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-10-16
Exploited in the wild
EPSS
25.98%
98.0th percentile
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ivanti | connect_secure | — | — |
| ivanti | connect_secure | — | — |
| ivanti | connect_secure | — | — |
| ivanti | connect_secure | — | — |
| ivanti | connect_secure | — | — |
| ivanti | connect_secure | >= 25.1.0.0 < 25.1.1.2 | 25.1.1.2 |
| ivanti | connect_secure | >= 25.1.2.0 < 25.1.3.0 | 25.1.3.0 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
vulncheck8.6HIGH
cisa8.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ivanti
Ivanti Security Advisory: CVE-2026-104935
vendor_ivanti·2026-10-13·CVSS 8.6
CVE-2026-104935 [HIGH] CWE-290 Ivanti Security Advisory: CVE-2026-104935
Ivanti Security Advisory: CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE IDs: CVE-2026-104935
CVSS Base Score: 8.6
Severity: HIGH
CWEs: CWE-290
CISA
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
cisa·2026-10-13·CVSS 8.6
CVE-2026-104935 [HIGH] CWE-290 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Vulnerability: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Affected: Ivanti Connect Secure
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https:/f
VulDB
Ivanti Connect Secure up to 22.7R2.13/22.8R2.4 improper authentication
vuldb·2026-10-13·CVSS 8.6
CVE-2026-104935 [HIGH] Ivanti Connect Secure up to 22.7R2.13/22.8R2.4 improper authentication
A vulnerability was found in Ivanti Connect Secure up to 22.7R2.13/22.8R2.4. It has been declared as very critical. This affects an unknown function. Executing a manipulation can lead to improper authentication.
This vulnerability is handled as CVE-2026-104935. The attack can be executed remotely. Additionally, an exploit exists.
It is recommended to upgrade the affected component.
GHSA
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
ghsa_unreviewed·2026-10-13
CVE-2026-104935 [HIGH] CWE-290 Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
VulnCheck
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
vulncheck·2026·CVSS 8.6
CVE-2026-104935 [HIGH] CWE-290 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Affected: Ivanti Connect Secure
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Exploitation References: http
No detection rules found.
Nuclei
Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header
nuclei·CVSS 8.6
CVE-2026-104935 [HIGH] Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header
Ivanti Connect Secure ]+/welcome\.cgi)'
- raw:
- |
GET {{welcome_path}} HTTP/1.1
Host: {{Hostname}}
X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi
matchers:
- type: dsl
dsl:
- 'contains_all(body, "upload file", "Browse buttons")'
- 'status_code == 200'
condition: and
# digest: 4a0a004730450220193d06a18ca5d11dd9ba42c291f55decce02558ded2f66b70187efe5d7b7e48f022100b5d45cf0d3d045469a8a03110df9457586bd5af9fae09558114c78e5e6c7a9b7:922c64590222798bb761d5b6d8e72950
Hackernews
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
blogs_hackernews·2026-10-19
CVE-2026-102764 ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.
This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were left so exposed that breaking in barely required any effort. Even AI agents crossed lines they weren't supposed to.
Some attacks were cleve
Checkpoint
19th October – Threat Intelligence Report
blogs_checkpoint·2026-10-19·CVSS 8.8
CVE-2026-35029 [HIGH] 19th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 19th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
Talos
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
blogs_talos·2026-10-15·CVSS 3.5
CVE-2014-125110 [LOW] The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
## The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Welcome to this week’s edition of the Threat Source newsletter.
I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse...
Let's look at some numbers:
We crossed the 70k mark, and it's only the end of September. This has never been seen before — I think we can agree this number is skyrocketing. Also, CVE numbering organically grew into the six-digit range. Check your tooling. Some might say we broke that barrier already in 2014 ( CVE-2014-125110 ), or even hit seven digits in 2015 ( CVE-2015-1000013 ), but th
Hackernews
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
blogs_hackernews·2026-10-14·CVSS 8.6
CVE-2026-104935 [HIGH] CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability.
The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior that could allow a remote unauthenticated attacker to execute arbitrary comma
Hackernews
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
blogs_hackernews·2026-10-13·CVSS 8.6
CVE-2026-104935 [HIGH] Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity.
Volexity, which reported the flaws to Ivanti, found the attack on one customer's appliance. The appliance was fully patched at the time and running version 22.8R2.4. The attacker, which Volexity t
Rapid7
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
blogs_rapid7·2026-10-13·CVSS 8.6
CVE-2026-104935 [HIGH] Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
## Overview
On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935 , a high-severity authentication bypass by spoofing ( CWE-290 ) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.
Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-day vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirms exploitation in the wild, and added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on the same day as the vendor's public disclosure. The digital forensics firm Volexity has pub
2026-10-13
Published
2026-10-13
Added to CISA KEV
Exploited in the wild