CVE-2026-104935

Connect Secure

94/100

confirmed exploited

CVSS8.6

EPSS26.0%

KEV (CISA + VulnCheck)EXPLOITED

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.260 (probability of exploitation) · CVSS base 8.6 · 3 public PoC/exploit reference(s) available

Public PoC / Exploit3

Defensive review only — these references demonstrate exploitability.

nuclei-templateIvanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header githubApexBreach/CVE-2026-104935-Proof-of-concept (★0)github0x45dd/ivanti-cve-2026-104935-check (★0)

References2

NVD detail Vendor advisoryhub.ivanti.com Referencecisa.gov

Mentions 9

cybersecuritynews.com
CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials
darkreading.com
Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
thehackernews.com
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
securityweek.com
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
securityaffairs.com
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
rapid7.com
Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
securityonline.info
Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access
cybersecuritynews.com
Ivanti Connect Secure 0-Day Vulnerability Actively Exploited in the Wild
securityonline.info
Ivanti Connect Secure Vulnerability CVE-2026-104935 Exploited in the Wild