Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Ivanti Connect Secure lets attackers run commands without login

CVE-2026-104935 · published 5 days ago · actively exploited
Summary

The Ivanti Connect Secure gateway can be tricked by a remote attacker who does not need any credentials, allowing them to execute commands on the system. This could let a malicious user take control of the server or access sensitive data. Apply the latest security update from Ivanti as soon as possible and verify that the system is running the patched version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ivanti connect secure All versions
ivanti connect_secure >= 25.1.0.0, < 25.1.1.2
>= 25.1.2.0, < 25.1.3.0
22.8
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
Original advisory text
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 3 days
and check for signs of compromise
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.6 High
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
26% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-104935 · CISA KEV
CVE-2026-104935 · NVD
CVE-2026-104935 · MITRE
Track software like this
Free during beta