CVE-2026-104935: Ivanti Connect Secure Authentication Bypass RCE (KEV)

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance, and CISA's own SSVC assessment records active exploitation; it was added to the KEV catalog the same day it was published.

CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) in Ivanti Connect Secure. NVD's description states it "allows a remote unauthenticated attacker to execute arbitrary commands" in ICS before version 25.1.3.0, and explicitly notes the flaw "does not impact ICS version 22.7R2.14 or prior" (NVD).

NVD lists the CVE as "Analyzed" with an Ivanti-submitted CVSS v3.1 base score of 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L — network-reachable, low attack complexity, no privileges or user interaction required (NVD).

NVD's configuration data lists the affected builds as Connect Secure 25.1.0.0 through 25.1.1.1 (fixed in 25.1.1.2), 25.1.2.0 through 25.1.2.x (fixed in 25.1.3.0), and 22.8 R2 through R2.4 (fixed in 22.8R2.5); version 22.7R2.14 and earlier builds are unaffected (NVD).

Ivanti's own hub.ivanti.com and forums.ivanti.com advisory pages for this CVE returned HTTP 403 to automated fetches during this review and could not be cited directly; CISA's KEV record instead carries the vendor-advisory link as a reference and CISA's own CVE record attaches an SSVC assessment with exploitation: active, automatable: yes and technicalImpact: total (NVD).

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-13, the same day as publication, with a required-action due date of 2026-10-16 and ransomware campaign use recorded as "Unknown" (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.8677 (99.740th percentile) — among the highest EPSS scores in this catalog, consistent with CISA's active-exploitation assessment (FIRST EPSS).

Because this is a confirmed, actively exploited unauthenticated path to remote command execution on a VPN gateway, any Ivanti Connect Secure deployment below the fixed builds should be upgraded immediately and checked for signs of prior compromise.

• Authentication bypass by spoofing in ICS before 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands; does not impact 22.7R2.14 or prior. — NVD
• CVSS v3.1 base score is 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, NVD status Analyzed; CISA's SSVC assessment records exploitation as active, automatable yes, technical impact total. — NVD
• Affected: Connect Secure 25.1.0.0-25.1.1.1 (fixed 25.1.1.2), 25.1.2.0-25.1.2.x (fixed 25.1.3.0), 22.8 R2-R2.4 (fixed 22.8R2.5); 22.7R2.14 and prior unaffected. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-13, due date 2026-10-16, ransomware campaign use Unknown. — CISA KEV
• EPSS score is 0.8677 (99.740th percentile) as of 2026-10-26. — FIRST EPSS