← Back to CVE Explorer
CVE-2026-104935
Critical
Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
Why this priority
Critical because this CVE is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog - confirmed active exploitation outranks every other signal.
CVSS score
8.6
CVSS severity
HIGH
EPSS score
—
EPSS percentile
—
CISA KEV
Yes - actively exploited
KEV remediation due
2026-10-16
Published
Oct 13, 2026
Last modified
Oct 13, 2026