Occurred Oct 13, 2026, 12:00:00 AM UTC

First published Oct 13, 2026, 3:21:15 PM UTC · Last updated Oct 13, 2026, 3:21:15 PM UTC

CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

The source describes an authentication-bypass vulnerability in Ivanti Connect Secure that could let a remote unauthenticated attacker execute arbitrary commands. It instructs stakeholders to apply vendor mitigations in line with CISA guidance, or discontinue use if mitigations are unavailable.

Illustrative image: © Belgian Presidency of the Council of the European Union / Julien Nizet — belgium24.eu/Wikimedia Commons, CC BY 2.0

Why it matters

The source identifies a vulnerability that could enable unauthenticated remote command execution and calls for mitigation or discontinuing the product.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 3/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 4/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 3/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Report an issue

Read our editorial process and corrections policy.