{"type":"bundle","id":"bundle--14618b7e-3f41-56a9-8ef6-80437ac5375c","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--b296c4dd-5a9a-5970-96a5-42793178db01","created":"2026-10-13T15:30:24.966Z","modified":"2026-10-13T15:30:24.966Z","name":"Ivanti Connect Secure login bypass exploited, on CISA KEV (CVE-2026-104935)","description":"Ivanti Connect Secure (ICS) has an authentication bypass by spoofing (CWE-290) that lets a remote unauthenticated attacker execute arbitrary commands on the VPN appliance. Ivanti disclosed it on 2026-10-13, rates it CVSS 8.6 (High), and says it is aware of exploitation in the wild affecting a limited number of customers. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a 2026-10-16 due date. Fixed builds: 25.1.1.2 (for 25.1.1.1 and prior), 25.1.3.0 or 25.1.3.1 (for 25.1.2.2 and prior), and 22.8R2.5 (for 22.8R2.4 and prior); Ivanti recommends 22.8 customers move to 25.1.1.2. ICS 22.7R2.14 and earlier are not affected. Ivanti says there are no reliable indicators of compromise yet and points suspected victims to its 22.8x and 25x recovery steps.","aliases":["CVE-2026-104935","Ivanti Connect Secure authentication bypass by spoofing","ICS CVE-2026-104935"],"first_seen":"2026-10-13T00:00:00.000Z","last_seen":"2026-10-13T15:26:11.061Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Ivanti Security Advisory: Ivanti Connect Secure (CVE-2026-104935)","url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"},{"source_name":"CISA Known Exploited Vulnerabilities catalog (2026.10.13)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"Ivanti Connect Secure 22.8x and 25x Recovery Steps","url":"https://forums.ivanti.com/s/article/Ivanti-Connect-Secure-22-8x-and-25x-Recovery-Steps"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-104935-ivanti-connect-secure-auth-bypass-kev"},{"source_name":"HOL Guard CVE evidence pack CVE-2026-104935","url":"https://hol.org/guard/security/cves/CVE-2026-104935"}]}]}