IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.6Hoch KEV

CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti Connect Secure Veröffentlicht: (vor 28 Tagen)

Bekannt ausgenutzt — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CISA hat am 13.10.2026 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 16.10.2026.

Erforderliche Maßnahme: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https:/forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 ; https://nvd.nist.gov/vuln/detail/CVE-2026-104935

Beschreibung

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Schwachstellentyp (CWE): CWE-290

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Ivanti Connect Secure fixed 25.1.3.0, fixed 25.1.3.1, fixed 22.8R2.5, fixed 22.7R2.14

Referenzen und Patches

CPE-Treffer (NVD) (7)
  • cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* ≥ 25.1.0.0 < 25.1.1.2
  • cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* ≥ 25.1.2.0 < 25.1.3.0
  • cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:*

Neue CVEs im selben Produkt — Ivanti (Connect Secure, EPMM…)

4.9Mittel
CVE-2026-83528
Ivanti Endpoint Manager Mobile

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.

5.5Mittel
CVE-2026-107405
Ivanti Endpoint Manager Mobile

An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.

4.9Mittel
CVE-2026-107404
Ivanti Endpoint Manager Mobile

Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

4.9Mittel
CVE-2026-105427
Ivanti Endpoint Manager Mobile

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

6.7Mittel
CVE-2026-105426
Ivanti Endpoint Manager Mobile

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

5.5Mittel
CVE-2026-123181
Ivanti Sentry

A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.