CVE-2026-104935

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CVSS

8.6

EPSS

—

CISA KEV

Added 2026-10-13, due 2026-10-16

Exploitation

active

Public exploits

None seen

State

PUBLISHED

Coverage

• ● Actively exploitedCritical 100SecurityWeek◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record1 hour ago

  Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

  CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.

  ↗securityweek.com/ivanti-zero-day-chain-gave-att…(opens the publisher's site in a new tab)
• 

  ● Actively exploitedCritical 100Rapid7◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards3 hours ago

  Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

  Overview On October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary…

  ↗rapid7.com/blog/post/etr-ivanti-connect-secure-…(opens the publisher's site in a new tab)

What we observed

1. 13 Oct, 15:00kev addedcisa-kev