Event Monitor Cyber
EM-20261102-B29V VulnerabilityHigh severity

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVE-2026-104935 · Ivanti Connect Secure

60 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 30 12:00 UTCC1 CISA Known Exploited Vulnerabilities
Page Born
Nov 02 00:00 UTCsecond source joined
Last Signal
Nov 03 08:54 UTC27 hours before snapshot
Sources
33 official · 0 research, news or crowd
Open For
5 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 30 12:00 UTC
    C1 first to name it
  2. Scored: reached
    Oct 30 12:00 UTC
    No CVSS yet · EPSS 88.9%
  3. Exploited: reached
    Nov 02 00:00 UTC
    C1 CISA KEV, fix by 2026-10-16
  4. Advisories: reached
    Nov 02 00:00 UTC
    2 government and CERT sources
  5. Vendor Response: not yet
    Not yet
    None in sources yet
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-10-16, then 14 quiet days

Timeline

12:00Oct 3112:00Nov 112:00Nov 212:00Nov 312:00BornC1 CISA Known Exploited VulnerabilitC13 CERT-FR (ANSSI)C15 NCSC-NL

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. NCSC-2026-0416 [1.01] [H/H] ZeroDay kwet baarheden verholpen in Ivanti Connect Secure (opens source in a new tab) Ivanti heeft meerdere kwetsbaarheden verholpen in Connect Secure. Een kwaadwillende kan de kwetsbaarheid (CVE-2026-104935 ) misbruiken om zonder voorafgaande authenticatie willekeurige commando's uit te voeren op het kwe… Med severityGovernmentC15 NCSC-NL
  2. Multiple vulnérabilité dan Ivanti Connect Secure (02 novembre 2026) (opens source in a new tab) De multiples vulnérabilités ont été découvertes dans Ivanti Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la … Med severityGovernmentC13 CERT-FR (ANSSI)
  3. CVE-2026-111357 added to KEV: Ivanti Connect Secure Mi ing Authentication for Critical Function Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  4. CVE-2026-118527 added to KEV: Ivanti Connect Secure Generation of Predictable Number or Identifier Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th… High severityExploited ListC1 CISA Known Exploited Vulnerabilities