CVE-2026-104935 in Ivanti Connect Secure: auth bypass without credentials
Ivanti disclosed CVE-2026-104935 (CWE-290, CVSS 8.6) in Connect Secure on October 13, 2026: a remote unauthenticated attacker can execute arbitrary commands. Exploitation in the wild was confirmed against a limited number of customers; fixes ship in 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5.
- CVSS 8.6, CWE-290: authentication bypass via spoofing
- Affects Connect Secure 25.1.1.1, 25.1.2.2 and 22.8R2.4 and earlier
- Fixed in 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5
- ZoomEye found 16,830 internet-facing instances
Read next
Security