CVE-2026-104935: 
Ivanti Connect Secure vulnerability analysis and mitigation

CVE-2026-104935 is an authentication bypass by spoofing vulnerability in Ivanti Connect Secure (ICS) that allows remote unauthenticated attackers to execute arbitrary commands. It affects ICS versions prior to 25.1.3.0, with the exception that versions 22.7R2.14 and earlier are not impacted. The vulnerability was disclosed on October 13, 2026, and carries a CVSS v3.1 base score of 8.6 (High) (Feedly, CISA KEV). Patched versions include 25.1.3.0, 25.1.3.1, and 22.8R2.5 (Feedly).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing), where the ICS product fails to properly validate the identity of a remote requestor, allowing an attacker to spoof a trusted identity and bypass authentication controls entirely. Exploitation requires no privileges, no user interaction, and is achievable over the network with low attack complexity, making it highly automatable. The vulnerability enables unauthenticated command execution on the affected appliance, and has been documented as part of chained zero-day exploitation scenarios by threat intelligence firm Volexity (Volexity, watchTowr).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary commands on the Ivanti Connect Secure appliance, resulting in high confidentiality impact, low integrity impact, and low availability impact per the CVSS scoring. Because ICS functions as a VPN gateway, compromise of the appliance can expose internal network segments, credentials, and session tokens to the attacker, enabling significant lateral movement into enterprise environments. The NVD SSVC assessment rates the technical impact as "total," reflecting the potential for full system compromise (Feedly, Volexity).

CVE-2026-104935 is being actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (CISA KEV). Volexity reported chained exploitation of this zero-day in targeted attacks, and the vulnerability has been flagged as automatable by NVD SSVC analysis (Volexity, Feedly). No public proof-of-concept exploit code has been confirmed, but active exploitation was observed prior to public disclosure, indicating zero-day use by threat actors (Feedly, BleepingComputer).

1. Reconnaissance: Identify internet-facing Ivanti Connect Secure appliances using tools such as Shodan or Censys, filtering for ICS versions between 22.7R2.14 (exclusive) and 25.1.3.0 (exclusive).
2. Craft spoofed authentication request: Construct a network request that exploits the authentication bypass by spoofing a trusted identity or session, bypassing the ICS authentication layer without valid credentials.
3. Execute arbitrary commands: Leverage the authentication bypass to send commands to the ICS appliance as an authenticated or privileged context, achieving remote code execution on the gateway.
4. Chain with additional exploits: As documented by Volexity, attackers have chained this vulnerability with other zero-days to escalate privileges, establish persistence, and pivot into internal network segments accessible via the VPN gateway (Volexity, watchTowr).

• Network: Unexpected or anomalous unauthenticated requests to ICS management or authentication endpoints; outbound connections from the ICS appliance to unknown external IP addresses; unusual VPN session establishment without corresponding valid authentication events.
• Logs: ICS access logs showing authentication success events with no corresponding valid credential submission; command execution traces in system logs originating from the ICS process context; log gaps or tampering consistent with attacker anti-forensics.
• Process/System: Unexpected processes spawned by the ICS service; new or modified files in ICS installation directories; evidence of web shells or backdoors deployed post-exploitation.
• Behavioral: Lateral movement from the ICS appliance into internal network segments; credential harvesting activity targeting VPN session tokens or internal authentication systems (Volexity, BleepingComputer).

Ivanti has released patched versions 25.1.3.0, 25.1.3.1, and 22.8R2.5 to address this vulnerability; organizations should upgrade immediately (Feedly). Note that ICS version 22.7R2.14 and earlier are not affected and do not require patching. For organizations unable to patch immediately, recommended interim measures include implementing network segmentation to restrict remote access to ICS systems, monitoring for suspicious authentication attempts or command execution, and deploying additional intrusion detection controls given confirmed active exploitation (CISA KEV, Feedly).

Volexity published a detailed threat intelligence blog documenting chained exploitation of this zero-day in targeted attacks, drawing significant attention from the security community (Volexity). watchTowr released both a technical analysis and an FAQ on the vulnerability, reflecting broad researcher interest (watchTowr). BleepingComputer and CyberSecurityNews covered the disclosure prominently, and security researchers on Mastodon and Bluesky (including accounts from Volexity and GossiTheDog) flagged the active exploitation rapidly after disclosure (BleepingComputer, Mastodon/Volexity). The NHS Digital also issued a cyber alert, indicating concern across critical infrastructure sectors (NHS Digital).