IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ivanti Connect Secure: Authentication bypass by spoofing

CVE-2026-104935High 8.6Actively exploitedPublic exploit

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 13 Oct 2026
Deadline for US federal agencies: 16 Oct 2026

Summary

Ivanti Connect Secure (ICS) versions before 25.1.3.0 contain an authentication bypass by spoofing (CWE-290). A remote, unauthenticated attacker can exploit it over the network to execute arbitrary commands on the appliance. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, so exploitation in the wild is confirmed. According to the CVE record, ICS 22.7R2.14 and earlier are not affected.

Affected

  • Ivanti Connect Secure before 25.1.3.0 (default: affected)
  • Not affected according to the CVE record: 25.1.3.0, 25.1.3.1, 22.8R2.5, 22.7R2.14 and earlier
  • Exact branch-level affected versions: verify in the Ivanti advisory

Fixed in

  • Upgrade to 25.1.3.0 or later (25.1.3.1 is listed as unaffected)
  • 22.8R2.5 for the 22.8 branch
  • Confirm the exact fixed release per branch in the Ivanti advisory

Workaround

Unknown.

  • No vendor workaround was confirmed in the sources reviewed; patching is the fix.
  • One source recommends restricting access to management and gateway interfaces wherever possible.

Exploitation

  • Exploited in the wild: CISA added the vulnerability to KEV on 13 October 2026. Ivanti has confirmed exploitation against a limited number of customers.
  • CISA SSVC assessment: exploitation active, automatable yes, technical impact total.
  • A public proof-of-concept exploit has been reported but not verified.
  • Use in ransomware campaigns: Unknown.

Our recommendation

  • Identify all Ivanti Connect Secure appliances and their exact versions; check whether management interfaces are internet-facing.
  • Upgrade to the fixed release without delay. Do not rely on the Integrity Checker Tool, which may not detect exploitation.
  • For internet-facing appliances left unpatched since early October 2026, assume compromise: review logs, follow Ivanti recovery guidance, rotate credentials and certificates handled by the appliance, and consider a rebuild.
  • Plan migration off branch 22.8 before its end of life on 31 January 2027.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:40.

Original description (NVD)

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed