CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026. It is an authentication bypass in Ivanti Connect Secure (ICS) that lets a remote, unauthenticated attacker run arbitrary commands.
What Is It
CVE-2026-104935 is an authentication bypass by spoofing flaw (CWE-290) in Ivanti Connect Secure. The NVD description says it allows a remote, unauthenticated attacker to execute arbitrary commands. Ivanti's CNA scores it CVSS 3.1 8.6 (HIGH), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. The attack runs over the network, has low complexity, and needs no privileges or user interaction.
Why It Matters
CISA KEV confirms active exploitation. The CVE record also carries an SSVC assessment from CISA's ADP enrichment. It rates exploitation as active, the flaw as automatable and its technical impact as total. The KEV entry is flagged for forensic triage, so CISA expects affected organizations to look for signs of compromise as well as patch. KEV lists known use in ransomware campaigns as "Unknown."
Federal agencies have a short deadline. The KEV due date is October 16, 2026, three days after the entry was added.
What's Vulnerable
The public records do not fully agree on which versions are affected, so check against Ivanti's advisory before deciding a device is safe.
- NVD description: ICS versions before 25.1.3.0 are affected. It also says ICS 22.7R2.14 and earlier are not affected.
- NVD CPE configuration: these versions are listed as vulnerable:
- 25.1.0.0 up to (but not including) 25.1.1.2
- 25.1.2.0 up to (but not including) 25.1.3.0
- 22.8R2, 22.8R2.1, 22.8R2.2, 22.8R2.3 and 22.8R2.4
- Vendor data: 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14 are listed as unaffected.
These sources conflict in two places. First, the CPE ranges leave out 25.1.1.2 up to 25.1.2.0, but the description's "before 25.1.3.0" wording would include those builds. Second, "before 25.1.3.0" would literally cover the 22.7 line, yet the description also says 22.7R2.14 and earlier are not affected. If you run a build in either of these areas, use the Ivanti advisory to confirm whether it is affected.
Patch Status
The vendor data lists ICS 25.1.3.0, 25.1.3.1 and 22.8R2.5 as unaffected. Ivanti has published a security advisory for this CVE.
CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." Organizations should follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders are responsible for checking each asset's internet exposure and following BOD 26-04 patching guidelines.