CVE-2026-104935: Ivanti Connect Secure Auth Bypass Flaw

CVE-2026-104935 Overview

CVE-2026-104935 is an authentication bypass by spoofing vulnerability [CWE-290] affecting Ivanti Connect Secure (ICS) before version 25.1.3.0. A remote unauthenticated attacker can exploit the flaw over the network to execute arbitrary commands on the affected appliance. ICS version 22.7R2.14 and prior are not impacted. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Given the role of Ivanti Connect Secure as a remote access gateway, successful exploitation provides attackers with a foothold at the network perimeter.

Critical Impact

Unauthenticated remote attackers can bypass authentication and execute arbitrary commands on exposed Ivanti Connect Secure appliances, enabling perimeter compromise and lateral movement.

Affected Products

• Ivanti Connect Secure versions prior to 25.1.3.0
• Ivanti Connect Secure 22.8 releases (R2, R2.1, R2.2, R2.3, R2.4)
• Not impacted: Ivanti Connect Secure 22.7R2.14 and prior

Discovery Timeline

• 2026-10-13 - CVE-2026-104935 published to NVD
• 2026-10-13 - Last updated in NVD database
• 2026-10-13 - Ivanti publishes security advisory for CVE-2026-104935

Technical Details for CVE-2026-104935

Vulnerability Analysis

The vulnerability is classified under [CWE-290: Authentication Bypass by Spoofing]. An attacker crafts requests that cause Ivanti Connect Secure to treat the session as authenticated without presenting valid credentials. Once the authentication layer is bypassed, the attacker reaches code paths that permit arbitrary command execution on the appliance.

Ivanti Connect Secure terminates remote access VPN sessions and typically sits at the network edge. Compromise of the gateway exposes internal network segments, session tokens, and configuration data to the attacker. The CISA KEV listing indicates confirmed in-the-wild exploitation, raising the priority above standard vendor advisories.

Root Cause

The root cause is improper verification of a client-supplied identity property that the appliance treats as proof of authentication. According to the Ivanti advisory, releases on the 25.x branch before 25.1.3.0 and the 22.8 branch share the vulnerable code path. The older 22.7R2.x maintenance branch does not share the affected logic and is unaffected.

Attack Vector

Exploitation requires only network reachability to the ICS management or user-facing web interface. No user interaction and no prior credentials are needed. The attacker sends a spoofed request to the HTTPS endpoint, bypasses authentication, and triggers command execution with the privileges of the processing service. Public technical references with proof-of-concept code are not currently available; refer to the Ivanti Security Advisory for CVE-2026-104935 for vendor-authored technical context.

Detection Methods for CVE-2026-104935

Indicators of Compromise

• Unexpected outbound connections or reverse shells originating from the ICS appliance management interface.
• New or modified files under web-accessible directories on the ICS appliance, especially scripts or binaries not present in a known-good baseline.
• Anomalous administrative sessions or configuration changes that lack a corresponding authentication event in audit logs.
• Appliance process executions spawning shell interpreters or network utilities outside normal operational patterns.

Detection Strategies

• Compare current ICS appliance file integrity against vendor-provided known-good hashes and the Ivanti Integrity Checker Tool (ICT) output.
• Correlate HTTPS request logs with successful authentication events; investigate sessions that reach privileged endpoints without a prior login event.
• Hunt for command execution patterns in appliance syslog forwarded to the SIEM, focusing on process names such as sh, bash, curl, wget, and python originating from web service accounts.

Monitoring Recommendations

• Forward ICS syslog, web access logs, and authentication logs to a centralized SIEM for continuous review.
• Alert on configuration or firmware state changes on the appliance that do not match an approved change window.
• Monitor egress traffic from the appliance management plane; the gateway should rarely initiate outbound connections to arbitrary internet hosts.

How to Mitigate CVE-2026-104935

Immediate Actions Required

• Upgrade all Ivanti Connect Secure instances to version 25.1.3.0 or later as published in the Ivanti advisory.
• Run the Ivanti Integrity Checker Tool on every appliance to detect signs of prior compromise before and after patching.
• Rotate credentials, API keys, and certificates stored on or accessible from the ICS appliance if compromise is suspected.
• Restrict administrative interface exposure to trusted management networks until patching is verified.

Patch Information

Ivanti has released a fixed build in Ivanti Connect Secure 25.1.3.0. Customers on the 22.8 branch must upgrade; the 22.7R2.14 and prior maintenance branch is not impacted and does not require this specific fix. Patch guidance and download links are published in the Ivanti Security Advisory for CVE-2026-104935. The vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog, which obligates U.S. federal agencies to remediate within the KEV-specified timeframe.

Workarounds

• No vendor-supplied workaround replaces upgrading; apply the 25.1.3.0 release as the primary remediation.
• Where immediate patching is not feasible, restrict inbound access to the ICS web interface using upstream firewall rules and allowlists.
• Consider temporarily moving affected 22.8 deployments to the unaffected 22.7R2.14 maintenance branch if operationally supported.

# Verify installed ICS version and confirm it is 25.1.3.0 or later
# Reference the Ivanti advisory for exact upgrade commands for your deployment model