CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Fix
Public exploits 6
- 0x45dd/ivanti-cve-2026-104935-check PoC on GitHub
- ApexBreach/CVE-2026-104935-Proof-of-concept PoC on GitHub
- Bluefire-Redteam-Cybersecurity/bluefire-ivanti-ics-guard PoC on GitHub
- CompleTetech-Security/ivanti-connect-secure-cve-2026-104935-check PoC on GitHub
- completetech-security/ivanti-connect-secure-cve-2026-104935-check PoC on GitHub
- maxprog-svg/CVE-2026-104935 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2026-10-16
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-13. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 7
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles Dark Reading · 2026-10-14
- Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks The Register · Security · 2026-10-14
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts The Hacker News · 2026-10-14
- Ivanti Connect Secure (CVE-2026-104935) r/blueteamsec · 2026-10-14
- Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) Rapid7 blog · 2026-10-13
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA advisories and alerts · 2026-10-13
- CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure CISA advisories and alerts · 2026-10-13
Change history 2
- EPSS0.26 → 0.87
- First seenCVSS 8.6 · in KEV · ivantiNVD modified 2026-10-13 19:24
Affected (CPE criteria) 6
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:*