Ivanti Connect Secure Ships Authentication That Can Be Spoofed. CISA Says Thursday.
Photo: Forkast
The perimeter has authentication. The authentication can be spoofed. Effective today, the CVE-2026-104935 record documents a vulnerability in Ivanti Connect Secure that lets a remote, unauthenticated attacker execute arbitrary commands on the VPN appliance without providing credentials. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Federal agencies have until Thursday. The vulnerability is classified as authentication bypass by spoofing, CWE-290. It affects Ivanti Connect Secure versions before 25.1.3.0 and does not affect version 22.7R2.14 or prior. The CVSS 3.1 base score is 8.6 High, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Remote, no privileges, no user interaction.
Source: Forkast
