{"id":"CVE-2026-104935","title":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands","summary":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-290"],"vendor":"ivanti","product":"connect_secure","affected":["connect_secure >= 25.1.0.0, < 25.1.1.2","connect_secure >= 25.1.2.0, < 25.1.3.0","connect_secure = 22.8"],"patched":["connect_secure 25.1.3.0"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T19:24:36.243","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","label":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild"],"kev":true,"kevDateAdded":"2026-10-13","kevDueDate":"2026-10-16","kevRansomware":false,"exploited":true,"zeroDay":true,"ingestedAt":"2026-10-13T16:35:46.738Z","slug":"CVE-2026-104935","body":"## Overview\n\nAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.\n\n## Affected\n\n- `connect_secure >= 25.1.0.0, < 25.1.1.2`\n- `connect_secure >= 25.1.2.0, < 25.1.3.0`\n- `connect_secure = 22.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `connect_secure 25.1.3.0`","depth":"abyssal","depthScore":72,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":25,"ransomware":0},"changes":[{"seq":219870,"id":"CVE-2026-104935","ts":1791920706907,"field":"zero_day","old":"false","new":"true"},{"seq":219869,"id":"CVE-2026-104935","ts":1791920706907,"field":"exploited","old":"false","new":"true"},{"seq":219868,"id":"CVE-2026-104935","ts":1791920706907,"field":"kev","old":"false","new":"true"}]}