CVE-2026-104935: Ivanti Connect Secure Authentication Bypass Vulnerability — Analysis & Mitigation
Summary On October 13, 2026, Ivanti disclosed CVE-2026-104935 , a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) — the company's enterprise SSL-VPN edge gateway — that lets a remote attacker with no credentials and no user interaction bypass authentication and execute arbitrary commands on the appliance. CISA added the flaw to its Known Exploited Vulnerabilities…
On October 13, 2026, Ivanti disclosed a high-severity authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935). The flaw allows a remote attacker to bypass authentication and execute arbitrary commands on the appliance without credentials or user interaction. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a three-day federal patch deadline of October 16, 2026.
The disclosure shows the dangers of identity access management failures at the network edge, as a single spoofable authentication signal can lead to initial access for an entire organization. Ivanti confirmed that versions before 25.1.3.0 are affected, including all 25.1.x releases and 22.8R2.4 and earlier. There is no workaround other than upgrading to the fixed versions.
The authentication bypass vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing) and has a CVSS score of 8.6 (High).
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
