Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Published: 2026-10-13
Score: 8.6 High
EPSS: n/a
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an authentication bypass that occurs when an attacker spoofs credentials in Ivanti Connect Secure’s Internet Control Software (ICS) before version 25.1.3.0. By exploiting this flaw, a remote attacker who does not have valid credentials can cause the system to execute arbitrary commands. The weakness is identified as CWE‑290 and results in a direct compromise of confidentiality and integrity of the affected system.

Affected Systems

Ivanti Connect Secure software is affected. All releases prior to 25.1.3.0 are vulnerable, while version 22.7R2.14 and earlier are not impacted.

Risk and Exploitability

The CVSS score of 8.6 indicates a high level of severity. KEV status confirms that the vulnerability has been actively exploited. The attack vector is remote and does not require authentication; an attacker can trigger the flaw over the network by presenting spoofed credentials. Because EPSS is not available, the exact exploitation probability is uncertain, but the KEV listing suggests that active exploitation is occurring.

Generated by OpenCVE AI on October 13, 2026 at 16:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Ivanti Connect Secure to version 25.1.3.0 or later, which contains the fix for the authentication bypass.
  • If an immediate upgrade is not possible, restrict external access to the Connect Secure service by implementing firewall rules or VPN restrictions so only trusted networks can contact the application.
  • Continuously monitor authentication logs for signs of spoofed or anomalous login attempts and configure alerts to notify security personnel of potential exploitation attempts.

Generated by OpenCVE AI on October 13, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Allowing Remote Code Execution via Spoofing in Ivanti Connect Secure

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Ivanti
Ivanti connect Secure
Vendors & Products Ivanti
Ivanti connect Secure

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

kev

{'dateAdded': '2026-10-13T00:00:00+00:00', 'dueDate': '2026-10-16T00:00:00+00:00'}

Subscriptions

Ivanti Connect Secure
cve-icon MITRE

Status: PUBLISHED

Assigner: ivanti

Published:

Updated: 2026-10-13T15:49:48.146Z

Reserved: 2026-10-02T17:07:30.656Z

Link: CVE-2026-104935

cve-icon Vulnrichment

Updated: 2026-10-13T15:41:46.714Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-13T16:17:11.640

Modified: 2026-10-13T17:26:16.840

Link: CVE-2026-104935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:00:17Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing