CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Other sources
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Connect Secureto a version that resolves this vulnerability.Fixed in 25.1.3.0
Event History
Frequently Asked Questions
Which deployments are affected?
Ivanti Connect Secure versions before 25.1.3.0 are affected, except that version 22.7R2.14 and earlier are explicitly not impacted.
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable without authentication or user interaction. An attacker can spoof authentication and execute arbitrary commands.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary command execution. The published severity vector indicates high confidentiality impact and low integrity and availability impact.