Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
5740 articles · 233882 vulns · 35/41 feeds (7d)
← Back to list
8.6
CVE-2026-104935PATCHED
Ivanti · Connect Secure

CVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

Description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Affected Products

VendorProductVersions
IvantiConnect Secure—

References

  • https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

Related News (7 articles)

Tier B
CCCS Canada1h ago
Ivanti security advisory (AV26-1035)
→ No new info (linked only)
Tier D
SecurityWeek2h ago
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
→ No new info (linked only)
Tier D
Heise Security3h ago
Security-Appliance: Angreifer nutzen Sicherheitslücke in Ivanti Connect Secure
→ No new info (linked only)
Tier D
The Hacker News3h ago
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
→ No new info (linked only)
Tier C
Rapid7 Blog3h ago
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
→ No new info (linked only)
Tier C
VulDB4h ago
CVE-2026-104935 | Ivanti Connect Secure up to 22.7R2.13/22.8R2.4 improper authentication
→ No new info (linked only)
Tier D
BleepingComputer5h ago
Ivanti warns of Connect Secure zero-day exploited in attacks
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.18.6 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CISA KEV❌ No
Actively exploited❌ No
Patch available
25.1.3.025.1.3.122.8R2.522.7R2.14
CWECWE-290
PublishedOct 13, 2026
Last enriched4h ago
Trending Score86
Source articles7
Independent7
Info Completeness8/14
Missing: versions, epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-109412
CVE-2026-109412: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv
Trending: 45
CRITICALCVE-2026-106042
CVE-2026-106042: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authent
Trending: 41
HIGHCVE-2026-106047
CVE-2026-106047: A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a r
Trending: 27
HIGHCVE-2026-106043
CVE-2026-106043: A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote u
Trending: 27
MEDIUMCVE-2026-106035
CVE-2026-106035: An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a re
Trending: 23

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 13, 2026
Discovered by ZDM
Oct 13, 2026
Patch Available
Oct 13, 2026