cyfenced.com →

[ CVE-2026-104935 · Published 13 Oct 2026 ]

Ivanti Connect Secure authentication bypass allows remote commands

Exploited · CISA KEV CVSS 8.6 EPSS 26%4 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-13
  • EPSS: 26% chance of exploitation in the next 30 days (higher than 98% of CVEs)
  • Urgent advisory from CERT-FR, NCSC-NL

[ Analyst view ]Is this a red alert for you?

Red alert

It is exploited as a zero-day according to CISA and NCSC-NL, and needs no credentials or user action.

Red alert if
You run Ivanti Connect Secure on a 25.x version before 25.1.3.0.
Can wait if
You run 22.7R2.14 or earlier, which is not affected, or do not use Connect Secure.
What it is
An authentication bypass by spoofing in Ivanti Connect Secure lets a remote attacker run commands without logging in. Versions before 25.1.3.0 are affected; 22.7R2.14 and earlier are not.
Impact
Anyone who can reach the VPN gateway from the internet can run commands on it without credentials. A compromised VPN appliance gives an attacker a trusted path into the internal network and access to the accounts of remote users.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends spoofed requests to the Connect Secure portal on the internet.
  2. T1059.004 Command and Scripting Interpreter: Unix ShellThe bypass lets them run commands on the appliance.
  3. T1505.003 Server Software Component: Web ShellAttackers commonly plant a web shell on VPN appliances to keep access.
  4. T1078 Valid AccountsVPN user credentials collected on the appliance are reused to move into the network.

What to do

  1. Upgrade Ivanti Connect Secure to 25.1.3.0 or later, as described in Ivanti's security advisory for CVE-2026-104935.
  2. Run Ivanti's Integrity Checker Tool and review the appliance logs for signs of compromise.
  3. If the appliance shows signs of compromise, follow Ivanti's recovery guidance: factory reset or rebuild, then restore a clean configuration.
  4. After any compromise, reset passwords and certificates for accounts and services that authenticated through the VPN.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CISA: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 16 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References