Summary
On October 13, 2026, Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) — the company's enterprise SSL-VPN edge gateway — that lets a remote attacker with no credentials and no user interaction bypass authentication and execute arbitrary commands on the appliance. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day, with a three-day federal patch deadline of October 16, 2026, confirming the bug was already being exploited in the wild as a zero-day. The disclosure is a textbook lesson in why identity access management failures at the network edge are among the most dangerous classes of vulnerability: Connect Secure sits between the public internet and the corporate network, so a single spoofable authentication signal can turn into an initial-access foothold for an entire organization.
The technical details make this one especially nasty. Ivanti confirmed that part of the underlying flaw was actually patched in the July 2026 release (25.1.3.0) — and that attackers exploited the weakness while the fix was still being backported to other supported branches. In other words, the patch itself revealed the attack surface. Investigation by incident-response firm Volexity found that real-world attackers chained this authentication bypass with a separate, still-unpatched privilege-escalation vulnerability, then used the access for credential theft and data exfiltration.
Perhaps most worrying for defenders: Ivanti's own Integrity Checker Tool — the standard utility admins run to detect appliance compromise — may not detect exploitation of this flaw, because the threat-actor commands execute in memory and leave little on disk. CISA's response was blunt: assume compromise, factory-reset the appliance, upgrade, and rotate every credential, certificate, and API key that touched the device.
Severity
CVE ID: CVE-2026-104935
Title: Ivanti Connect Secure — authentication bypass (CWE-290) leading to unauthenticated remote code execution
CVSS 3.1: 8.6 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack requirements: None — unauthenticated, remote, low complexity, no user interaction
Weakness: CWE-290 — Authentication Bypass by Spoofing
Exploitation status: Confirmed zero-day exploitation in the wild against a limited number of customers; added to CISA KEV catalog on October 13, 2026 (federal deadline: October 16, 2026, with a forensic-triage flag)
Affected Versions
Ivanti confirmed the following Ivanti Connect Secure releases are affected — every version before 25.1.3.0, including:
25.1.1.1 and all earlier 25.1.1.x releases
25.1.2.2 and all earlier 25.1.2.x releases
22.8R2.4 and all earlier 22.8R2.x releases
Not affected: ICS 22.7R2.14 and earlier (a legacy branch that lacks the vulnerable code path).
Fixed versions: 25.1.3.0 and 25.1.3.1, 22.8R2.5, and 25.1.1.2 for the 25.1.1 branch. There is no workaround — upgrading is the only remediation.
Technical Analysis
Authentication bypass vulnerabilities (CWE-290) all share one structural trait: somewhere in the login flow, the application trusts a signal it should verify. In the case of CVE-2026-104935, the Ivanti Connect Secure login flow trusts a client-supplied, spoofable authentication signal instead of requiring the client to actually prove its identity. Think of it this way: imagine a building where the guard asks for your badge, but accepts a sticky note with "I'm an employee" written on it because it looks roughly like a badge. That is effectively what the vulnerable ICS code does — it takes the attacker's word for an authentication claim that the server never independently validates.
Once that claim is accepted, the attacker is inside the authenticated session path without ever providing a username or password. From there, the flaw allows execution of arbitrary commands on the appliance — turning an authentication weakness into full remote code execution. This is the classic "bypass → escalate → command execution" chain, and it is exactly why authentication bypasses on internet-facing appliances score so high: there is no user to phish, no session to steal, no timing window to catch. One unauthenticated HTTP interaction is enough.
Identity Access Management: Why a Spoofable Signal Is the Worst Kind of Bug
Identity access management is supposed to answer one question — "are you who you claim to be?" — before any other access decision is made. When that first gate is implemented with a trust assumption instead of a verification step, every downstream control inherits the failure: authorization checks, session permissions, and admin APIs all operate on the fiction that the attacker is legitimate. That is why the blast radius of CVE-2026-104935 is not "the attacker can log in" but "the attacker can run commands on the appliance." A single missed verification at the identity layer collapses the entire security model.
There is a second, subtler lesson here for anyone who maintains edge appliances. Ivanti's advisory notes that part of this flaw was patched in 25.1.3.0 back in July 2026, and exploitation occurred while the patch was being backported to other branches. Every time a vendor ships a fix for one branch, diff-hungry attackers can study exactly what changed and aim the same technique at unpatched sibling branches. Patch windows on other branches are no longer theoretical grace periods — they are the exact window adversaries race to exploit.
The Chained Exploit and the Detection Blind Spot
According to the Volexity investigation referenced by CISA, real-world attackers did not stop at the authentication bypass. They chained it with an as-yet-unpatched privilege-escalation vulnerability to deepen their control, then used the access for credential theft and data exfiltration. This is the modern edge-appliance attack pattern: the initial foothold is rarely the end goal — it is the beachhead for identity harvesting.
The detection guidance is sobering. Ivanti's Integrity Checker Tool — the utility most admins rely on to verify an appliance has not been tampered with — may miss this exploitation entirely, because the threat actor's commands run in memory and leave little persistent on-disk evidence. CISA's recommendation reflects that reality: network and memory forensics, factory reset of the appliance followed by an upgrade to a fixed version, and full rotation of every credential, certificate, and API key that transited the device. If your ICS appliance was internet-facing and unpatched on October 13, the only defensible assumption is that it was probed — and you should respond accordingly.
FAQ: Key Questions on CVE-2026-104935
What does vulnerable mean in the context of CVE-2026-104935? It means the appliance's login flow accepts a spoofable client claim as proof of identity, so any remote attacker — no credentials, no user interaction — can walk past authentication and execute commands on the VPN gateway itself.
How does an identity access management failure become unauthenticated RCE? Because once the forged identity claim is accepted, all later checks (session validity, permissions, command authorization) treat the attacker as a legitimate authenticated party. The identity gate is the foundation; when it trusts instead of verifies, the command-execution layer inherits that trust.
Can I detect exploitation with Ivanti's Integrity Checker Tool? Not reliably. The attacker's commands execute in memory, so the checker may report a clean appliance. Use network and memory forensics instead — and if the appliance was exposed and unpatched, treat it as compromised until proven otherwise.
Why This Matters
Edge VPN appliances have become the single most targeted class of infrastructure on the internet, and for good reason: they are always on, always reachable, and they sit at the exact boundary between the untrusted internet and the trusted internal network. The security of cyberspace for most organizations depends disproportionately on a handful of these edge devices — and this year has delivered a grim parade of them: Fortinet, Cisco, Citrix, SonicWall, and now Ivanti, all in the same disclosure window as this flaw.
For defenders, CVE-2026-104935 belongs in the same family as the recent Cisco Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504) — another unauthenticated, internet-facing identity failure with no workaround — and the SonicWall SMA1000 pre-auth flaw (CVE-2026-102255). The pattern is unmistakable: attackers are systematically working through edge-appliance identity and input-validation code, and weaponization now routinely arrives within hours or days of disclosure. Organizations that treat edge-appliance patching as routine maintenance are consistently outpaced by adversaries who treat it as a race.
Mitigation
Upgrade immediately — no workaround exists. Move to 25.1.3.0/25.1.3.1, 22.8R2.5, or 25.1.1.2 (for the 25.1.1 branch) or any later release. CISA's federal deadline is October 16, 2026 — but weaponization is already confirmed, so treat this as an emergency change, not a scheduled one.
Assume compromise on exposed appliances. Because the Integrity Checker Tool may not detect exploitation, CISA advises factory-resetting the appliance and then upgrading — rather than upgrading in place over a potentially compromised image.
Rotate everything. Every credential, certificate, and API key that passed through an exposed appliance should be considered compromised: VPN credentials, admin accounts, LDAP/AD service accounts, SAML certificates, and API tokens.
Hunt with network and memory forensics. Review firewall, proxy, and VPN logs around October 13 for anomalous unauthenticated requests to the ICS login path, outbound connections from the appliance to unknown infrastructure, and signs of credential harvesting. Memory forensics can catch what disk checks miss.
Reduce edge exposure structurally. Restrict ICS management and login interfaces to the narrowest possible network path (VPN-of-VPN, allow-listed admin ranges, geo-restriction), and keep a tested, offline backup of appliance configurations so factory reset is a procedure, not a panic.
References
Analysis by Faizan Akhtar, Cyber Security Researcher and Bug Bounty Hunter.
Report by Faizan Akhtar — The Cyber Security Researcher
Top comments (0)