ICS actively exploited auth bypass RCE (CVE-2026-104935) [PoC]

Actively exploited in the wild - CVE-2026-104935 is a high-severity authentication bypass in ICS before version 25.1.3.0 that grants remote unauthenticated attackers arbitrary command execution on affected systems. ICS 22.7R2.14 and earlier releases are not impacted; upgrading to 25.1.3.0 closes the flaw.

Overview

CVE-2026-104935 is an authentication bypass caused by spoofing in ICS. An attacker can impersonate a trusted identity and skip the login process entirely, then run commands of their choosing on the host. No credentials, no user interaction, and no special network position are required: the vulnerable service is reachable over the network and the attack complexity is low, which is why the CVSS score sits at 8.6.

The spoofing angle matters. Unlike a brute-force or credential-stuffing attack, spoofing does not trigger failed-login alarms. An intrusion can look like a legitimate session in the logs, letting an attacker dwell, pivot to connected systems, and exfiltrate data before anyone notices. Because ICS is commonly deployed in industrial and operational technology environments, a compromised instance can serve as a foothold into production networks where availability and safety matter as much as confidentiality.

Impact

Successful exploitation gives an attacker the same privileges the ICS service holds. In practice that means arbitrary command execution: reading or altering configuration, deploying malware, disrupting operations, or using the host as a jumping-off point into adjacent segments. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming real-world attacks are underway, not theoretical risk.

Organizations running ICS versions older than 25.1.3.0 should assume they are targets. Breach reports are available at breach reports and ongoing coverage at security news.

Remediation

• Upgrade ICS to version 25.1.3.0 or later immediately. This is the only complete fix.
• If immediate upgrade is not possible, isolate affected instances behind strict firewall rules, restrict management interfaces to trusted hosts, and disable remote access paths where feasible.
• Hunt for signs of compromise: unexpected processes, new scheduled tasks, unfamiliar outbound connections, and authentication events that succeed without a matching login attempt.
• Rotate credentials and secrets stored or cached on any host that may have been exposed.
• Monitor vendor and CISA guidance for updated indicators of compromise, since exploitation is confirmed.

Security Insight

Authentication bypass by spoofing is an unusually quiet class of bug: it produces successful-looking logins rather than failures, so detection tooling tuned to brute-force patterns will miss it. That silence, combined with confirmed exploitation and a low-complexity network vector, is what pushed this into CISA’s catalog so quickly. It also highlights a recurring pattern in industrial software: trust decisions made without cryptographic verification tend to fail closed only after attackers have already tested them in production.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs