Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

What's on the official record

13 October — CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes an authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure that allows a remote unauthenticated attacker to execute arbitrary commands. CISA's remediation due date for federal civilian agencies is 16 October 2026. The record names no fixed version. FIRST's EPSS model estimates a 0.260 probability of exploitation (98th percentile, 23 October 2026). CISA's ADP rates exploitation active, automatable yes, and impact total. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Ivanti Connect Secure instance in your estate is running a version affected by CVE-2026-104935, and to apply the mitigations in the vendor advisory before the 16 October 2026 federal due date. The record names no fixed version, so the decision is to isolate or restrict affected appliances until the vendor's instructions are applied.

For a cyber underwriter, the record lets you check whether a policyholder's estate includes Ivanti Connect Secure and whether the vendor's mitigations have been applied, given CISA's ADP rating of active exploitation and total impact. The catalog does not record known ransomware use, so the record supports requiring a control rather than pricing ransomware exposure.

What would change this call

A fixed version named in a revised Ivanti advisory, a change in CISA's ADP SSVC ratings, or a ransomware notation later recorded in the catalog would change this call.

What to check next

Confidence

Filed 25 October 2026 from the record dated 13 October 2026. The note is built from the official CISA Known Exploited Vulnerabilities Catalog entry and the CVE record; the EPSS figure is FIRST's EPSS model estimate and the SSVC ratings are attributed to CISA's ADP.

Sources

[1] Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-104935

[2] CVE record CVE-2026-104935 — https://www.cve.org/CVERecord?id=CVE-2026-104935

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog