Zero Radar
← feed
CriticalVulnerabilityCVE-2026-104935updated 25 Oct 2026, 17:35 UTC

Ivanti Connect Secure: login bypass lets attackers run commands remotely

Attackers can get past the login screen without a password and then run commands on the device. The device is a remote-access gateway, so attackers could reach the internal network behind it.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.6 of 10
Being exploited?YesConfirmed by CISA KEV · 13 Oct 2026
Fix available?YesUpgrade to Ivanti Connect Secure 25.1.3.0 or later. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo credentials needed
  2. 2Spoofed requestSent to the login interface
  3. 3Auth bypassLogin check is skipped
  4. 4Command executionArbitrary commands run on device
  5. ResultAttacker controls the VPN appliance

What happened

An authentication bypass by spoofing in Ivanti Connect Secure (ICS) lets an unauthenticated remote attacker execute arbitrary commands. CISA has confirmed exploitation and added it to its Known Exploited Vulnerabilities catalog.

Why it is dangerous: Successful exploitation gives an outsider control over an internet-facing VPN appliance, which can expose the internal network and its data. Organizations that expose ICS to the internet are most at risk.

Are you affected?

You are affected if you run Ivanti Connect Secure before version 25.1.3.0 and it is reachable from the internet.

Ivanti Connect Secure (ICS) versions before 25.1.3.0. Per the advisory, ICS 22.7R2.14 and earlier are not impacted.

What to do

  1. Upgrade Ivanti Connect Secure to version 25.1.3.0 or later
  2. Apply the vendor mitigations and follow CISA BOD 26-04 guidance for prioritized patching
  3. Check the device for signs of compromise using CISA's forensics triage requirements
  4. Limit internet exposure of the appliance while patching

Timeline

  1. 13 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 13 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to Ivanti Connect Secure 25.1.3.0 or later.

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-104935 · GHSA-vm2g-whwh-xhq8
CVSS
8.6 / 10
EPSS
87% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ivanti Connect Secure: login bypass lets attackers run commands remotely · Zero Radar