VulnRadar

Data against noise.

Built with NaN
Page generated: 06 Nov 2026, 03:50 UTC
← Dashboard

CVE-2026-104935

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CVSS 8.6 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
7.2/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.6: +1.29
  • Fresh EPSS: 88.94%: +0.44

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 36 documents and public datasets.

Hype components

Headline sample (25%)
50/100
Press, 30 days (60%)
100/100
Grounded branding (15%)
0/100
HYPE TOTAL72/100

Sources and documents

Help Net Security
Press · 02 Nov 2026, 15:58 · CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) - Help Net Security
Rapid7
Press · 02 Nov 2026, 11:06 · Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) - Rapid7
Rapid7 Cybersecurity Blog
Press · 02 Nov 2026, 11:04 · Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
BleepingComputer
Press · 02 Nov 2026, 09:33 · Ivanti patches two more Connect Secure zero-days chained in attacks - BleepingComputer
SecurityWeek
Press · 02 Nov 2026, 07:59 · Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain - SecurityWeek
See all 36 source documents
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 02 Nov 2026, 02:47 · Ivanti Connect Secure Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre
CERT-FR
Technical advisory · 02 Nov 2026, 00:00 · Multiples vulnérabilités dans Ivanti Connect Secure (02 novembre 2026)
Security Affairs
Press · 31 Oct 2026, 22:02 · U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
Security Affairs
Press · 31 Oct 2026, 19:33 · U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog
news.lavx.hu
Press · 31 Oct 2026, 12:42 · Attackers chain three Ivanti Connect Secure flaws for unauthenticated root access - news.lavx.hu
The Hacker News
Press · 31 Oct 2026, 08:27 · Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access - The Hacker News
CCB Belgium
Press · 31 Oct 2026, 02:24 · Warning: Actively Exploited Vulnerabilities in Ivanti Connect Secure, Patch Immediately! - CCB Belgium
www.thestack.technology
Press · 30 Oct 2026, 01:55 · Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation - www.thestack.technology
SOC Prime
Press · 19 Oct 2026, 17:00 · CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited in Chained Attacks - SOC Prime
Cisco Talos Blog
Press · 15 Oct 2026, 18:00 · The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Cisco Talos Blog
Press · 15 Oct 2026, 07:00 · The Q3 Vulnerability Pulse: Discovery ≠ Exploitation - Cisco Talos Blog
SOC Prime
Press · 14 Oct 2026, 23:17 · CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticated Code Execution - SOC Prime
Dark Reading
Press · 14 Oct 2026, 07:00 · Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles - Dark Reading
Cyber Press
Press · 14 Oct 2026, 07:00 · Ivanti VPN Zero-Day Attack Bypasses Authentication and Gains Root Privileges - Cyber Press
BleepingComputer
Press · 14 Oct 2026, 07:00 · CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - BleepingComputer
SOCRadar
Press · 14 Oct 2026, 07:00 · Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks - SOCRadar
The Hacker News
Press · 14 Oct 2026, 07:00 · CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts - The Hacker News
GBHackers News
Press · 14 Oct 2026, 07:00 · Ivanti Connect Secure CVE-2026-104935 Flaw Enables Unauthenticated Remote Code Execution - GBHackers News
CCB Belgium
Press · 14 Oct 2026, 07:00 · Warning: Actively Exploited Zero-Day Vulnerability in Ivanti Connect Secure Allows Remote Code Execution, Patch Immediately! - CCB Belgium
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 14 Oct 2026, 02:15 · Ivanti Connect Secure Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
CERT-FR
Technical advisory · 14 Oct 2026, 00:00 · Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)
CERT-FR
Press · 14 Oct 2026, 00:00 · Vulnérabilité dans Ivanti Connect Secure (ICS) (14 octobre 2026)
Rapid7 Cybersecurity Blog
Press · 13 Oct 2026, 17:06 · Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
Security Affairs
Press · 13 Oct 2026, 07:00 · U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog - Security Affairs
BleepingComputer
Press · 13 Oct 2026, 07:00 · Ivanti warns of Connect Secure zero-day exploited in attacks - BleepingComputer
Rapid7
Press · 13 Oct 2026, 07:00 · Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935) - Rapid7
The Hacker News
Press · 13 Oct 2026, 07:00 · Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far - The Hacker News
shattered.io
Press · 13 Oct 2026, 07:00 · Ivanti VPN Zero-Day Hits CVSS 8.6, Root Still Open [2026] - shattered.io
CyberSecurityNews
Press · 13 Oct 2026, 07:00 · Ivanti Connect Secure 0-Day Vulnerability Actively Exploited in the Wild - CyberSecurityNews
watchTowr
Press · 20 Sep 2026, 14:03 · Fortinet FortiClient EMS Zero-Day: CVE-2026-35616 (Active Exploitation Underway) - watchTowr
shattered.io
Press · 13 Oct 2016, 07:00 · Ivanti, BeyondTrust Zero-Days: KEV Oct. 13 and 16 [2026] - shattered.io

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 7.5Reality 8.702 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 7.2Reality 8.7Nov 2Nov 2

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.6; EPSS 88.9%
Attention, last 30 days
32 distinct story titles; 32 press documents; 5 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:51.107056+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
13 Oct 2016, 07:00
Added to the CISA KEV catalog
13 Oct 2026, 00:00
Published
13 Oct 2026, 15:31
Latest press mention
02 Nov 2026, 15:58
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar