Vulnerability Details CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Exploit prediction scoring system (EPSS) score
CVSS Severity
CVSS v3 Score 8.6
Proposed Action
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Ransomware Campaign
Unknown
References
Products affected by CVE-2026-104935
-
cpe:2.3:a:ivanti:connect_secure:22.8
-
cpe:2.3:a:ivanti:connect_secure:25.1.2.0
-
cpe:2.3:a:ivanti:connect_secure:25.1.2.1
-
cpe:2.3:a:ivanti:connect_secure:25.1.2.2