HighCVECVE-2026-104935
[CVE-2026-104935] Ivanti Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
Key details
- Citrix NetScaler ADC and Gateway have a memory buffer vulnerability that could allow remote code execution or denial of service.
- Organizations must apply vendor mitigations and follow BOD 26-04 patching guidelines.
- Running provided IOCs in the NetScaler console may help identify exploitation indicators.
Affected
- Citrix NetScaler ADC and NetScaler Gateway are affected.
Fixes and mitigations
- Apply mitigations per vendor instructions and follow Citrix's published guidance for mitigations.
What to look for
- Running provided IOCs in the NetScaler console may help identify exploitation indicators.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.