Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
TL;DR 📌
- Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
- Listed in CISA KEV (2026-10-13) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-104935.
What it is
CVE-2026-104935 is an authentication bypass by spoofing vulnerability in Ivanti Connect Secure. It allows a remote, unauthenticated attacker to execute arbitrary commands.
The flaw sits in the authentication mechanism itself rather than in a downstream feature, which means an attacker does not need valid credentials, a prior foothold, or any interaction from a legitimate user. The path to the vulnerable component is over the network, consistent with an internet-facing VPN gateway.
The advisory text supplied does not specify which authentication check is spoofed or which protocol handler is involved, so the exact mechanism should be confirmed against Ivanti’s own advisory rather than assumed. What is clear is the outcome: successful exploitation leads directly to arbitrary command execution, not just an authentication pass.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-13.
What to do
- Treat any internet-facing Ivanti Connect Secure instance as a priority, given the unauthenticated network-based access path and arbitrary command execution outcome.
- No fixed version is listed in the current facts; check Ivanti’s advisory directly for the patched release and apply it as soon as it’s available.
- Because this is in CISA KEV, federal and enterprise patch policies that mandate KEV remediation timelines apply — confirm your internal SLA for KEV-listed CVEs and track this one against it.
- Until a fix is confirmed and applied, review exposure: restrict management and authentication endpoints to trusted networks where feasible, and check logs for anomalous authentication events or command execution on the gateway.
- Subscribe to or monitor Ivanti’s advisory page for CVE-2026-104935 directly, since fixed version details were not available at the time of writing.
For leadership 🧭
Executive summary. Ivanti Connect Secure, a VPN gateway many organisations expose to the internet, has an authentication bypass that lets a remote attacker with no credentials execute arbitrary commands on the box. It is listed in CISA’s Known Exploited Vulnerabilities catalogue, so treat this as urgent, not routine patch-cycle work.
Why it matters:
- The flaw bypasses authentication itself, so an attacker needs no valid account, no stolen credentials and no action from a legitimate user to reach the vulnerable code.
- The access path is over the network to what is typically an internet-facing VPN gateway, widening the pool of potential attackers to anyone who can reach the appliance.
- Successful exploitation results in arbitrary command execution, not just a login bypass, meaning an attacker can run their own commands on the gateway itself.
- CISA has added this CVE to its Known Exploited Vulnerabilities catalogue, confirming it is being used in the wild.
Now / Next / Later:
- Now: Identify every internet-facing Ivanti Connect Secure instance in your estate and check Ivanti’s own advisory for CVE-2026-104935 for a patched release, since none was listed at time of writing.
- Next: Where a fix is not yet available, restrict access to the gateway’s authentication and management interfaces to trusted networks and review authentication and command logs for anomalies.
- Later: Confirm this CVE is tracked against your organisation’s mandated KEV remediation SLA and set up monitoring of Ivanti’s advisory page so the patch is applied the moment it ships.