UpHeron
All vulnerabilities

Servers and applications

CVE-2026-104935

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 13 Oct 2026.

Severity
High 8.6
Published
13 Oct 2026
Last changed
13 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
25.1.1.2, 25.1.3.0
Sources
NVD

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • From 25.1.2.0 before 25.1.3.0
  • From 25.1.0.0 before 25.1.1.2
  • Version 22.8-r2.4
  • Version 22.8-r2.3
All 7 release lines
  • Version 22.8-r2
  • Version 22.8-r2.1
  • Version 22.8-r2.2
  • Version 22.8-r2.3
  • Version 22.8-r2.4
  • From 25.1.0.0 before 25.1.1.2
  • From 25.1.2.0 before 25.1.3.0

Known exploited

CISA name
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
16 Oct 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-104935
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-104935