{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-529AB19A",
  "slug": "cve-2026-104935-ivanti-connect-secure-auth-bypass-kev",
  "title": "Ivanti Connect Secure login bypass exploited, on CISA KEV (CVE-2026-104935)",
  "aliases": [
    "CVE-2026-104935",
    "Ivanti Connect Secure authentication bypass by spoofing",
    "ICS CVE-2026-104935"
  ],
  "summary": "Ivanti Connect Secure (ICS) has an authentication bypass by spoofing (CWE-290) that lets a remote unauthenticated attacker execute arbitrary commands on the VPN appliance. Ivanti disclosed it on 2026-10-13, rates it CVSS 8.6 (High), and says it is aware of exploitation in the wild affecting a limited number of customers. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Fixed builds: 25.1.1.2 (for 25.1.1.1 and prior), 25.1.3.0 or 25.1.3.1 (for 25.1.2.2 and prior), and 22.8R2.5 (for 22.8R2.4 and prior); Ivanti recommends 22.8 customers move to 25.1.1.2. ICS 22.7R2.14 and earlier are not affected. Ivanti says there are no reliable indicators of compromise yet and points suspected victims to its 22.8x and 25x recovery steps.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "Ivanti has not published technical details of the spoofing or indicators of compromise. The advisory lists only Connect Secure; Policy Secure, ZTA Gateways and Neurons for Secure Access are not mentioned. Vendor CVSS is 8.6 (High); this campaign marks severity critical because of confirmed in-the-wild exploitation and KEV listing, not a different score.",
  "firstObservedAt": "2026-10-13T00:00:00.000Z",
  "lastObservedAt": "2026-10-13T15:26:11.061Z",
  "publishedAt": "2026-10-13T15:30:24.966Z",
  "reviewedAt": "2026-10-13T15:30:15.377Z",
  "expiresAt": "2026-10-13T15:26:11.061Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ivanti-advisory",
      "label": "Ivanti Security Advisory: Ivanti Connect Secure (CVE-2026-104935)",
      "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-13T15:26:11.061Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA Known Exploited Vulnerabilities catalog (2026.10.13)",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "sourceType": "government",
      "observedAt": "2026-10-13T15:26:11.061Z"
    },
    {
      "id": "ivanti-recovery",
      "label": "Ivanti Connect Secure 22.8x and 25x Recovery Steps",
      "url": "https://forums.ivanti.com/s/article/Ivanti-Connect-Secure-22-8x-and-25x-Recovery-Steps",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-13T15:26:11.061Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-104935-ivanti-connect-secure-auth-bypass-kev",
      "sourceType": "other_primary",
      "observedAt": "2026-10-13T15:26:11.061Z"
    },
    {
      "id": "hol-evidence",
      "label": "HOL Guard CVE evidence pack CVE-2026-104935",
      "url": "https://hol.org/guard/security/cves/CVE-2026-104935",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T15:26:11.061Z"
    }
  ],
  "artifacts": [],
  "indicators": [],
  "timeline": [
    {
      "id": "july-partial-fix",
      "occurredAt": "2026-07-01T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Per Ivanti's FAQ, a portion of the vulnerability was found internally and patched in the July 2026 release 25.1.3.0 (new ISA4500/6500/8500 platform). Exact July date not stated; first of month used as a placeholder.",
      "sourceIds": [
        "ivanti-advisory"
      ]
    },
    {
      "id": "fix-25-1-1-2",
      "occurredAt": "2026-10-05T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Ivanti released ICS 25.1.1.2, which resolves the vulnerability for 25.1.1.1 and prior.",
      "sourceIds": [
        "ivanti-advisory"
      ]
    },
    {
      "id": "fix-22-8r2-5",
      "occurredAt": "2026-10-12T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Ivanti released ICS 22.8R2.5, which resolves the vulnerability for 22.8R2.4 and prior.",
      "sourceIds": [
        "ivanti-advisory"
      ]
    },
    {
      "id": "disclosure",
      "occurredAt": "2026-10-13T00:00:00.000Z",
      "eventType": "disclosure",
      "summary": "Ivanti published the advisory for CVE-2026-104935 and confirmed exploitation in the wild affecting a limited number of customers. Volexity credited.",
      "sourceIds": [
        "ivanti-advisory"
      ]
    },
    {
      "id": "kev-added",
      "occurredAt": "2026-10-13T14:34:17.000Z",
      "eventType": "other",
      "summary": "CISA added CVE-2026-104935 to the KEV catalog (version 2026.10.13) with a due date of 2026-10-16.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-10-13T15:26:11.061Z",
      "eventType": "other",
      "summary": "HOL Guard published the operator write-up for CVE-2026-104935.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Tracks CVE-2026-104935 in Ivanti Connect Secure only.",
    "Not in scope: ICS 22.7R2.14 and earlier, and 25.1.3.0 or later on ISA4500/ISA6500/ISA8500, which Ivanti says do not contain the bug.",
    "No indicators of compromise are included because Ivanti says reliable ones are not available.",
    "HOL blog is operator guidance, not a substitute for the vendor advisory."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-104935-ivanti-connect-secure-auth-bypass-kev/corrections"
}