Overview
Ivanti has disclosed CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure, its widely deployed enterprise VPN gateway. Ivanti confirms the flaw is already being exploited in the wild against a limited number of customers at the time of disclosure, making this an active zero-day rather than a theoretical risk.
The vulnerability allows a remote, unauthenticated attacker to bypass the appliance's login checks entirely and go on to execute arbitrary commands on the device — a combination that has repeatedly made Ivanti's secure-access product line a top target for both opportunistic and state-sponsored actors.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-104935 |
| Severity | High |
| CVSS Score | 8.6 |
| Weakness | CWE-290 (Authentication Bypass by Spoofing) |
| Attack Vector | Network |
| Authentication | None Required |
| Exploitation Status | Confirmed active exploitation (limited customers) |
How It Works
The flaw allows an attacker to spoof the conditions Connect Secure relies on to validate a session or identity, slipping past the login workflow without presenting valid credentials. Once past authentication, the attacker can execute commands on the appliance — turning what starts as a logic flaw into full remote code execution on an internet-facing VPN gateway.
Affected and Fixed Versions
| Affected Branch | Fixed In |
|---|---|
| 25.1.1.1 and prior | 25.1.1.2 |
| 25.1.2.2 and prior | 25.1.3.0 / 25.1.3.1 |
| 22.8R2.4 and prior | 22.8R2.5 |
Ivanti notes that version 22.7R2.14 and earlier is not affected.
Impact Assessment
Who Is At Risk
Any organization running an affected Connect Secure build with the appliance reachable from the internet — which describes the vast majority of production deployments, since Connect Secure is designed as an internet-facing remote-access gateway.
Potential Attack Chains
- Spoofed Authentication — Attacker bypasses the login/session check without valid credentials
- Command Execution — Post-bypass access enables arbitrary command execution on the appliance
- Internal Network Access — Connect Secure's position as a VPN gateway gives attackers a foothold directly into the internal network it protects
- Credential and Session Theft — Historical Ivanti exploitation chains have paired initial access with credential harvesting and persistence via modified system files
Mitigation
Immediate Actions
- Patch immediately: upgrade to 25.1.1.2, 25.1.3.0/25.1.3.1, or 22.8R2.5 depending on your branch
- Assume compromise on any appliance that was internet-facing and unpatched — review for indicators of exploitation before and after patching
- Review Ivanti's advisory directly for the latest guidance, as details were still emerging at time of disclosure
- Check CISA's KEV catalog for updates; it had not yet listed this CVE as of publication, but given confirmed in-the-wild exploitation that status should be expected to change quickly
Detection Opportunities
- Review Connect Secure logs for anomalous authentication events or session creation without corresponding valid login activity
- Run Ivanti's Integrity Checker Tool (ICT) to look for signs of filesystem tampering
- Monitor for unexpected outbound connections or new administrative accounts created on the appliance
Defence-in-Depth
- Where possible, restrict management-plane access to the appliance separately from the VPN data plane
- Maintain offline, verified backups of appliance configuration for rapid rebuild if compromise is confirmed
- Treat edge VPN appliances as high-value targets requiring expedited patch SLAs, given this product line's exploitation history
Background: Ivanti Connect Secure as a Target
Ivanti's Connect Secure and Policy Secure products have been repeatedly targeted by nation-state and ransomware-affiliated actors in prior incidents, including chained authentication-bypass-to-RCE exploit chains documented in CISA advisories AA24-060B and AA25-022A. CVE-2026-104935 continues that pattern: a pre-auth bypass on an internet-facing gateway, already weaponized before broad public disclosure. Organizations still running Connect Secure should treat patching as urgent regardless of whether they have observed exploitation themselves.
References
- Ivanti Connect Secure Vulnerability CVE-2026-104935 Exploited in the Wild
- CISA AA25-022A — Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications
- CISA AA24-060B — Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways
- CISA Known Exploited Vulnerabilities Catalog