## Overview
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026. This vulnerability affects Ivanti Connect Secure (ICS) versions prior to 25.1.3.0. It allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands. The urgency of this addition stems from evidence of active exploitation in the wild.
## Technical Details
CVE-2026-104935 is classified as an authentication bypass by spoofing vulnerability. Attackers can exploit this flaw without needing valid credentials, making it particularly dangerous. The vulnerability exists in all versions of ICS before 25.1.3.0, while version 22.7R2.14 and earlier are not affected. The flaw can be exploited to gain unauthorized access and execute commands remotely.
## Impact
The impact of this vulnerability is significant. Successful exploitation can lead to full control over affected systems. This could allow attackers to manipulate data, disrupt services, or launch further attacks within the network. Organizations using vulnerable versions of ICS should prioritize this vulnerability to prevent potential breaches.
## Mitigation
Defenders should immediately update Ivanti Connect Secure to version 25.1.3.0 or later. Regularly review and apply security patches to all systems. Monitor network traffic for signs of exploitation attempts. Implement strict access controls and limit exposure of ICS to untrusted networks. Conduct security assessments to identify and remediate any vulnerabilities in your infrastructure.
CSURFACE Threat Sensor