Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)

Catalog analysis: CISA added this entry on October 13, 2026. The entry reflects catalog information retrieved on October 13, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-104935 is an authentication bypass vulnerability (CWE-290) affecting Ivanti Connect Secure. The flaw allows a remote, unauthenticated attacker to spoof identity and execute arbitrary commands on the affected system.

Exposure and applicability

This vulnerability applies to deployments of Ivanti Connect Secure. Because the exploit path is remote and does not require prior authentication, any instance exposed to the internet or untrusted network segments is at high risk of unauthorized command execution. Organizations should prioritize assets based on their level of internet exposure.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions:

1. Apply Vendor Mitigations: Immediately implement the corrective actions provided by Ivanti to close the authentication bypass path.
2. Perform Forensic Triage: Because this vulnerability allows unauthenticated access, applying a patch does not eliminate the risk of existing persistence. Defenders must follow CISA’s “Forensics Triage Requirements” to determine if the system was compromised prior to remediation.
3. Federal Compliance Check: Covered federal agencies must ensure these actions are completed by the CISA-mandated deadline of October 16, 2026, per BOD 26-04.

How to validate remediation

Verification of this fix requires a two-pronged approach to ensure exposure is actually reduced:

• Mitigation Deployment: Confirm that the vendor-supplied mitigations are active on all identified Ivanti Connect Secure assets. A version check or configuration audit confirms the fix is deployed, but it does not prove the system is secure from prior exploitation.
• Integrity Validation: Use the required forensic triage tools and processes to verify the absence of unauthorized artifacts or persistence mechanisms. The result of this triage provides the evidence that the asset has been returned to a known-secure state.

Limits and open questions

Applying mitigations reduces the likelihood of future exploitation but does not retroactively remove an attacker who may have already gained access. There is residual risk if forensic triage is skipped or incomplete. It remains unknown whether this vulnerability has been utilized in ransomware campaigns.

Source and editorial note

CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability · Source date: October 13, 2026 · Retrieved October 13, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment