Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| connect secure | = 22.8≥ 25.1.0.0, < 25.1.1.2≥ 25.1.2.0, < 25.1.3.0 | 25.1.1.225.1.3.0 |
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free