Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Exploited since 2026-10-13. 1 of 8 rule sources name it. Our CRS test: not blocked.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Edge coverage
Claimed by vendorsAsk Vigil
AI · answers from this pageWorkers AI (Llama 3.3). Can be wrong: check the cited source.
Severity, decoded
CVSS 3.1Exploitable over the network, with no privileges and no user interaction, leading to full loss of confidentiality and low impact on integrity and availability.
How the score is built
- Attack vectorAn attacker can reach it over the internet; no access to your network needed.Network
- Attack complexityNo special conditions are needed; the attack works reliably.Low
- Privileges requiredNo account or login is needed.None
- User interactionNo one has to click or open anything; the attack works on its own.None
- ScopeThe damage stays within the vulnerable component.Unchanged
- Confidentiality impactAn attacker can read all data the affected component holds, or the most sensitive parts of it.High
- Integrity impactAn attacker can change some data, but with limited control or limited effect.Low
- Availability impactAn attacker can slow the component down or interrupt it now and then.Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LAttackers are exploiting this in the wild.
Attackers can script the attack end to end and hit many targets at once.
A successful attack gives full control over the affected software or all of its data.
Public exploits
1 found- NucleiCVE-2026-104935.yamldetection template, replayed in our lab
Links are to third-party code: never run it outside an isolated lab.
Timeline
- 2026-10-13CVE publishedCVE List
- 2026-10-13Added to CISA KEVConfirmed exploitation in the wild
- 2026-10-21F5 ships a ruleIvanti Pulse Connect Secure Authentication Bypass (2)
- 2026-11-02
- 2026-11-02Our test: OWASP Core Rule Set let it throughparanoia level 1, anomaly threshold 5, default CRS settings
- 2026-11-02Our test: OWASP Core Rule Set let it throughparanoia level 2, anomaly threshold 5, default CRS settings
Vendor statements
QuotedCloudflareWAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Each row gives the rule ID and its default action. The feed starts in January 2025, so older rules are missing.
AWSAWS WAF Managed Rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.
Microsoft AzureFront Door and Application Gateway WAF (DRS)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.
Google CloudCloud Armor preconfigured WAF rules
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.
FastlyNext-Gen WAF virtual patches
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The feed holds only the latest 25 changes, so history builds up from the day we started reading it.
F5Attack signatures (Distributed Cloud WAF)
First rule 2026-10-21, 8 days after the CVE was published.
Added: signature 200013235 "Ivanti Pulse Connect Secure Authentication Bypass (2)" (Authentication/Authorization Attacks, risk High), systems: Other Web Server. References: CVE-2026-104935.
AkamaiApp & API Protector (Adaptive Security Engine)
This vendor publishes no machine-readable rule changelog we can check.
OWASP CRSCore Rule Set (open source, used inside many WAFs)
We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.
Social
Top posts
Three chained Ivanti Connect Secure zero-days (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) exploited in the wild since October 3, granting unauthenticated root access. All three are now in CISA KEV. Patches exist for all three as of October 29. Key findings: - The chain…
【Ivanti VPN、3つの欠陥をつなぐ侵入】 Connect SecureのCVE-2026-104935・111357・118527をつなぎ、認証なしでroot権限を得る攻撃が確認されている。 Volexityは、ウェブシェルを残さずログを消す手口を報告し、Integrity Checkerだけでは侵害を見つけにくいと指摘した。