CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated...
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- Record
CVE-2026-104935- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2026-98816
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- Record
EUVD-2026-98816- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vm2g-whwh-xhq8
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated...
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- Record
GHSA-vm2g-whwh-xhq8- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
CISA KEV No score
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
- Record
CVE-2026-104935- Weakness
- CWE-290
- Updated
- 2026-11-02
NVD
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- Record
CVE-2026-104935- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-290
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | ApexBreach/CVE-2026-104935-Proof-of-concept | 2026-10-13 |
| PoC in GitHub | 0x45dd/ivanti-cve-2026-104935-check | 2026-10-15 |
| PoC in GitHub | Bluefire-Redteam-Cybersecurity/bluefire-ivanti-ics-guard | 2026-10-22 |
| PoC in GitHub | maxprog-svg/CVE-2026-104935 | 2026-10-22 |
| PoC in GitHub | CompleteTech-Security/ivanti-connect-secure-cve-2026-104935-check | 2026-10-23 |
| Nuclei | Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-104935 is a high vulnerability (CVSS 8.6) in Ivanti Connect Secure, published October 13, 2026. CISA lists it as known to be exploited, since October 13, 2026. EUVD reports exploitation since October 13, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 88.9%, the 99th percentile. No source names a fixed version.