CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
8.6CVSS base score · high (NVD)
89%Chance of exploitation in the next 30 days (FIRST EPSS)
ExploitedIn CISA KEV · federal patch deadline Oct 16, 2026
What happened
CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog. The missing authentication flaw in Ivanti Connect Secure allows authenticated attackers to escalate privileges and can be chained with two other vulnerabilities. Federal agencies must apply mitigations by November 2, 2026, following BOD 26-04 guidance or discontinue use if patches are unavailable.
From the Intel60 brief of Oct 30, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalCISA adds Ivanti Connect Secure auth bypass to KEVOct 30, 2026
- CriticalCISA adds Ivanti Connect Secure upload flaw to KEVOct 30, 2026