CVE-2026-104935

HighCVSS 8.6/10Known exploited (CISA KEV)Last modified Oct 13, 2026

Description

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-290

Affected software

VendorProductVersions
IvantiConnect Secure—

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
Added to CISA KEV
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1049378.1Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enCVE-2026-1049397.5Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may CVE-2026-1049447.1TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticCVE-2026-1049456.8TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client canCVE-2026-1049475.3WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backenCVE-2026-1049487.1WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the builCVE-2026-1049492.3WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_cCVE-2026-1049536.8The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database queryCVE-2026-1049555.4Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-membeCVE-2026-1049565.3Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_bCVE-2026-1049606.5Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspaceCVE-2026-1049615.4Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require is_active=True when checking whet