{"id":"EM-20261102-B29V","url":"https://cyber.eventmonitor.net/incident/EM-20261102-B29V/","type":"cve","title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","subtitle":"CVE-2026-104935","subject":"CVE-2026-104935","status":"Confirmed","severity":"high","affected":["Ivanti Connect Secure"],"headline":"60 hours from first report to confirmed exploitation.","born":"2026-11-02T00:00:00.000Z","firstSignal":"2026-10-30T12:00:00.000Z","lastSignal":"2026-11-03T08:54:04.000Z","updated":"2026-11-04T09:04:34.499Z","revision":2,"life":[{"status":"Born","at":"2026-11-02T00:00:00.000Z","why":"second independent source: C13 CERT-FR (ANSSI)"},{"status":"Developing","at":"2026-11-02T00:00:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-11-02T00:00:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-30T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-11-02T00:00:00.000Z","what":"Born: second source, C13 CERT-FR (ANSSI). Page EM-20261102-B29V created."},{"at":"2026-11-02T00:00:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-11-03T08:54:04.000Z","what":"Source joined: C15 NCSC-NL"}],"stages":[{"name":"Disclosed","at":"2026-10-30T12:00:00.000Z","detail":"C1 first to name it"},{"name":"Scored","at":"2026-10-30T12:00:00.000Z","detail":"No CVSS yet · EPSS 88.9%"},{"name":"Exploited","at":"2026-11-02T00:00:00.000Z","detail":"C1 CISA KEV, fix by 2026-10-16"},{"name":"Advisories","at":"2026-11-02T00:00:00.000Z","detail":"2 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-10-16, then 14 quiet days"}],"signals":[{"at":"2026-10-30T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-118527 added to KEV: Ivanti Connect Secure Generation of Predictable Number  or Identifier  Vulnerability","text":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-30T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-111357 added to KEV: Ivanti Connect Secure Mi ing Authentication for Critical Function Vulnerability","text":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-11-02T00:00:00.000Z","source":"C13","sourceName":"CERT-FR (ANSSI)","role":"Government","severity":2,"title":"Multiple  vulnérabilité  dan  Ivanti Connect Secure (02 novembre 2026)","text":"De multiples vulnérabilités ont été découvertes dans Ivanti Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité. Ivanti indique que les vulnérabilités CVE-2026-104935,...","url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1442/"},{"at":"2026-11-03T08:54:04.000Z","source":"C15","sourceName":"NCSC-NL","role":"Government","severity":2,"title":"NCSC-2026-0416 [1.01] [H/H] ZeroDay kwet baarheden verholpen in Ivanti Connect Secure","text":"Ivanti heeft meerdere kwetsbaarheden verholpen in Connect Secure. Een kwaadwillende kan de kwetsbaarheid (CVE-2026-104935 ) misbruiken om zonder voorafgaande authenticatie willekeurige commando's uit te voeren op het kwetsbare systeem. Ivanti meldt op de hoogte te zijn van rapporten dat de kwetsbaarheid als ZeroDay kwetsbaarheid is misbruikt. Er is (nog) geen publieke Proof-of-Concept (PoC) beschi","url":"https://advisories.ncsc.nl/advisory?id=NCSC-2026-0416"}],"crowd":[],"reference":{"nvd":null,"kev":{"added":"2026-10-13","due":"2026-10-16","ransomware":"Unknown","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability"},"epss":{"epss":0.88936,"pct":0.99778,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}