Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Reports indicate that threat actors have been exploiting three Ivanti Connect Secure flaws since at least October 3. Apply the available patches as soon as possible.

Ivanti says they are aware of limited exploitation of a new high severity vulnerability in Ivanti Connect Secure (ICS). Fixed versions are available now.

The Ivanti Connect Secure instance is affected by an authentication bypass caused by inconsistent routing between the web front end and internal CGI dispatcher. Authorization is evaluated using the request URL, while the X-DSCGI-PATH header controls the CGI handler that is executed. A remote, unauthenticated attacker can exploit this discrepancy to access protected CGI handlers, including the wu.cgi file upload functionality, through a publicly accessible welcome.cgi endpoint.

The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.5, 25.1.0.x or 25.1.1.x prior to 25.1.1.2, or 25.1.2.x prior to 25.1.3.0. It is, therefore, affected by an authentication bypass by spoofing vulnerability:

  - An authentication bypass by spoofing in Ivanti Connect Secure allows a remote unauthenticated attacker to     execute arbitrary commands. Ivanti states this does not impact version 22.7R2.14 or prior. (CVE-2026-104935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115688	Ivanti Connect Secure < 22.8R2.5 / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.1 Authentication Bypass	Web App Scanning	Component Vulnerability	Check Based	medium
365566	Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2026-104935

high

Tenable Plugins

medium

high