Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Published: 2026-10-13
Score: 8.6 High
EPSS: 86.8% High
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an authentication bypass that occurs when an attacker spoofs credentials in the Ivanti Connect Secure component referred to as “ICS” in the description. By exploiting this flaw, a remote unauthenticated attacker can cause the system to execute arbitrary commands, resulting in a direct compromise of confidentiality, integrity, and availability. The weakness is catalogued as CWE‑290.

Affected Systems

Affected releases are Ivanti Connect Secure versions 22.8 r2.1 through r2.4 and all other releases prior to 25.1.3.0, except for versions 22.7R2.14 and earlier, which are not impacted.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity, and the EPSS score of 87% shows a high probability of exploitation. The vulnerability is listed in CISA’s KEV catalog, signifying active exploitation. The attack vector is remote; authentication is not required, and an attacker can trigger the flaw over the network by presenting spoofed credentials.

Generated by OpenCVE AI on October 25, 2026 at 17:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Ivanti Connect Secure to version 25.1.3.0 or later, which contains the fix for the authentication bypass.
  • If an immediate upgrade is not possible, restrict external access to the Connect Secure service by implementing firewall rules or VPN restrictions so only trusted networks can contact the application.
  • Continuously monitor authentication logs for signs of spoofed or anomalous login attempts and configure alerts to notify security personnel of potential exploitation attempts.

Generated by OpenCVE AI on October 25, 2026 at 17:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 25 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Allowing Remote Command Execution in Ivanti Connect Secure

Sat, 17 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Allowing Remote Code Execution via Spoofing in Ivanti Connect Secure

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:*

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Authentication Bypass Allowing Remote Code Execution via Spoofing in Ivanti Connect Secure

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Ivanti
Ivanti connect Secure
Vendors & Products Ivanti
Ivanti connect Secure

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

kev

{'dateAdded': '2026-10-13T00:00:00+00:00', 'dueDate': '2026-10-16T00:00:00+00:00'}

Subscriptions

Ivanti Connect Secure
cve-icon MITRE

Status: PUBLISHED

Assigner: ivanti

Published:

Updated: 2026-10-13T19:58:23.946Z

Reserved: 2026-10-02T17:07:30.656Z

Link: CVE-2026-104935

cve-icon Vulnrichment

Updated: 2026-10-13T15:41:46.714Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T16:17:11.640

Modified: 2026-10-13T19:24:36.243

Link: CVE-2026-104935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T17:45:15Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing