CVE-2026-104935Vulnerability
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Reported by 19 independent sources · first reported by CISA advisories · last reported
Last reported 5 days ago
Fix due 16 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
27 reports · the newest 20, newest first · the exact sentence from each-
19th October – Threat Intelligence Report“Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials.”
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More“…ka), CVE-2026-102764 (BeyondTrust Remote Support), CVE-2025-61624 (Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager), CVE-2026-104935 (Ivanti Connect Secure), and multiple vulnerabilities in Google BoringSSL.”
-
Bulletin d'actualité CERTFR-2026-ACT-044 (19 octobre 2026)“Le 13 octobre 2026, Ivanti a publié un avis concernant la vulnérabilité CVE-2026-104935 affectant Ivanti Connect Secure (ICS).”
-
CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability“CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass and Remote Code Execution Vulnerability”
-
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation“CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.”
-
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles“CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.”
-
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog“Cybersecurity and Infrastructure Security Agency (CISA) also added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Kev Catalog.”
-
Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks“On Tuesday, Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw discovered by Volexity.”
-
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts“The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior that could allow a remote unauthenticated attacker to execute arbitrary commands.”
-
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities“The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.””
-
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks“Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks”
-
Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances“Ivanti has released a patch for the authentication bypass and RCE vulnerability (CVE-2026-104935), and is working on a fix for the privilege escalation portion of the exploit chain.”
-
Múltiples vulnerabilidades en productos de Ivanti“Las versiones 22.7R2.14 y anteriores de Ivanti Connect Secure no están afectadas por CVE-2026-104935.”
-
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products“The Connect Secure update deserves special attention, as it resolves CVE-2026-104935, an exploited zero-day that covers two underlying bugs chained together to compromise patched VPNs.”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“[Ivanti CVE-2026-104935 // Volexity]”
-
Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)“Bulletin de sécurité Ivanti Security Advisory Ivanti Connect Secure (CVE-2026-104935) du 13 octobre 2026”
-
Multiples vulnérabilités dans les produits Ivanti (14 octobre 2026)“Bulletin de sécurité Ivanti Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 du 13 octobre 2026”
-
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day“The company said it initially discovered a portion of the high-severity vulnerability — CVE-2026-104935 — during internal security checks in June.”
-
Ivanti security advisory (AV26-1035)“On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-CVE-2026-104935 to their Known Exploited Vulnerabilities (KEV) Database.”
-
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure“CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.”
Indicators reported together
named in the same reports- 25.1.2[.]2in 6 reports
- 25.1.1[.]2in 5 reports
- 25.1.3[.]1in 5 reports
- 25.1.1[.]1in 3 reports
- 9f1f11a708d393e0…06f18ffcc507in 1 report
- 2915b3f8b703eb744fc54c81f4a9c67fin 1 report
- w32.9f1f11a708-100.sbx[.]tgin 1 report
- fed979f93bcaf4e7…c50ce509ad2fin 1 report
- 207d9d891ac756b2bfad88aba5682c65in 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2026-96951, CVE-2026-109412, CVE-2026-97229, CVE-2026-106042, CVE-2026-102764, CVE-2026-106173, CVE-2026-107656, CVE-2026-76519, CVE-2026-0322, CVE-2025-8088, CVE-2026-34073
Thanks — we review every report.