{"id":"CVE-2026-104935","title":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands","summary":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-290"],"vendor":"ivanti","product":"connect_secure","affected":["connect_secure >= 25.1.0.0, < 25.1.1.2","connect_secure >= 25.1.2.0, < 25.1.3.0","connect_secure = 22.8"],"patched":["connect_secure 25.1.3.0"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T19:24:36.243","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","label":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","cve.org","exploit-available"],"kev":true,"kevDateAdded":"2026-10-13","kevDueDate":"2026-10-16","kevRansomware":false,"exploited":true,"zeroDay":true,"ingestedAt":"2026-10-13T16:35:46.738Z","exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-13T15:42:16.582526Z"},"epss":0.86766,"epssPercentile":0.99741,"exploits":{"github":5,"githubRepos":["https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept","https://github.com/0x45dd/ivanti-cve-2026-104935-check","https://github.com/maxprog-svg/CVE-2026-104935"],"nuclei":["CVE-2026-104935"],"checkedAt":"2026-10-27T16:54:16.787Z"},"slug":"CVE-2026-104935","body":"## Overview\n\nAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\n\n## Affected\n\n- `connect_secure >= 25.1.0.0, < 25.1.1.2`\n- `connect_secure >= 25.1.2.0, < 25.1.3.0`\n- `connect_secure = 22.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `connect_secure 25.1.3.0`","depth":"abyssal","depthScore":90,"depthScoreParts":{"impact":47.3,"likelihood":17.4,"exploitation":25,"ransomware":0},"changes":[{"seq":229816,"id":"CVE-2026-104935","ts":1793089979885,"field":"epss","old":"0.25982","new":"0.86766"},{"seq":223888,"id":"CVE-2026-104935","ts":1792267229406,"field":"epss","old":null,"new":"0.25982"},{"seq":221152,"id":"CVE-2026-104935","ts":1792030765878,"field":"exploit_available","old":"false","new":"true"},{"seq":219870,"id":"CVE-2026-104935","ts":1791920706907,"field":"zero_day","old":"false","new":"true"},{"seq":219869,"id":"CVE-2026-104935","ts":1791920706907,"field":"exploited","old":"false","new":"true"},{"seq":219868,"id":"CVE-2026-104935","ts":1791920706907,"field":"kev","old":"false","new":"true"}]}