home / blog
2026-10-13 · high
Ivanti Connect Secure: authentication bypass by spoofing (CVE-2026-104935)
Authentication bypass by spoofing in Ivanti Connect Secure before 25.1.3.0, listed in CISA KEV, CVSS 8.6. Update to 25.1.3.0.
On 13 October 2026 the record for CVE-2026-104935 was published, an authentication bypass by spoofing in Ivanti Connect Secure before version 25.1.3.0. According to NVD, a remote unauthenticated attacker can run arbitrary commands on the VPN gateway. The CVSS v3.1 score is 8.6.
The vulnerability is in CISA's KEV catalogue, so it is reported as actively exploited. Ivanti states that 22.7R2.14 and earlier are not affected: anyone on an older branch should check their version.
Update to 25.1.3.0 and review VPN gateway logs for anomalous access, unrecognised sessions and configuration changes. A compromised VPN gateway gives access to the internal network, so the check should come first.
At a glance
- What
- A remote unauthenticated attacker can run arbitrary commands on the Ivanti Connect Secure VPN gateway, bypassing authentication through spoofing.
- Severity
- CVSS v3.1 8.6 (high), according to NVD.
- Affected versions
- Connect Secure before 25.1.3.0. According to the advisory, 22.7R2.14 and earlier are not affected.
- Fix
- Ivanti Connect Secure 25.1.3.0.
- Status
- Listed in CISA KEV, so reported as actively exploited.
- Action
- Update to 25.1.3.0 and review gateway logs for anomalous access.
Sources: NVD, CVE-2026-104935 · Ivanti, avviso di sicurezza · CISA, catalogo KEV