Source: cisa.gov
CVE-2026-104935 is a critical authentication bypass by spoofing vulnerability affecting Ivanti Connect Secure. The flaw allows remote unauthenticated attackers to execute arbitrary commands on affected systems. No local access or credentials are required to exploit this vulnerability, making it particularly dangerous. The vulnerability has been disclosed via CISA and documented in the NVD. Ivanti has published a security advisory with remediation guidance. The high criticality rating reflects the severity of unauthenticated remote code execution potential. Organizations using Ivanti Connect Secure should apply patches or mitigations immediately.
