Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

1. 2026-10-13 Added to CISA KEV
2. 2026-10-13 Published
3. 2026-10-13 CISA SSVC: exploitation active
4. 2026-10-16 CISA patch deadline

Added

27 d ago (2026-10-13)

Patch by

2026-10-16 (24 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

Ivanti, Connect Secure

CISA name

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

26 d ago (2026-10-13)

88.94% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Nuclei template Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header nuclei detection template

• Ivanti Connect Secure

Weakness

• CWE-290 Authentication Bypass by Spoofing

Technology feeds

• Ivanti rss critical rss

• hub.ivanti.com /s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935

  government-resource, us-government-resource

• CVE List CVE-2026-104935
• NVD CVE-2026-104935

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.