CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Enables Unauthenticated Command Execution

Background

Ivanti Connect Secure (formerly Pulse Connect Secure) is an SSL VPN appliance used by organizations to provide remote employees with secure access to internal networks and applications. By design, it is internet-facing — remote access is the product’s entire purpose — which makes any pre-authentication vulnerability in it especially consequential.

Connect Secure has an extensive recent history of actively exploited vulnerabilities. CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282 — all unauthenticated or pre-authentication flaws in the same product line — were exploited at scale, in some cases by sophisticated actors conducting long-term espionage campaigns against government and enterprise targets, and in other cases by opportunistic attackers once proof-of-concept exploit code became public. That track record is important context for assessing CVE-2026-104935, even though no specific actor has been publicly attributed to this particular CVE in the data available for this analysis — Connect Secure’s exposure profile and its history of rapid weaponization after disclosure both argue for treating this vulnerability with urgency regardless of attribution status.

CVE-2026-104935 is an authentication bypass by spoofing vulnerability that CISA states allows a remote unauthenticated attacker to execute arbitrary commands.

Technical Mechanism

CWE-290, Authentication Bypass by Spoofing, describes a weakness where a system grants access or trust based on an identity assertion — a header, token, source attribute, or similar signal — that can be forged or spoofed by an attacker without possessing genuine credentials. Rather than exploiting a logic flaw in the authentication check itself, this class of vulnerability exploits insufficient verification of the thing the authentication check relies on.

Applied to Connect Secure, the likely mechanism is that some component of the authentication or session-trust evaluation accepts a spoofable signal — for example, a client-supplied header, a trust assumption about request origin, or an improperly validated token — as sufficient evidence of legitimate prior authentication or internal trust. An attacker who can forge that signal is treated by the appliance as if they had already authenticated, without ever presenting valid credentials.

Once that bypass is achieved, CISA’s description indicates the attacker can execute arbitrary commands — meaning the now-”trusted” access path leads to functionality on the appliance that accepts input and passes it to the underlying operating system for execution. This mirrors the pattern seen in prior Connect Secure CVEs (e.g., CVE-2024-21887), where an authentication-bypass vulnerability was paired with or directly led to command injection, together forming a complete unauthenticated remote code execution chain. The practical result is that an attacker needs no credentials and no user interaction: a single crafted request against the appliance’s management or authentication-handling interface can yield command execution.

Real-World Exploitation Evidence

CVE-2026-104935 was added to CISA’s KEV catalog on 2026-10-13, with a remediation deadline of 2026-10-16 — a three-day window consistent with CISA’s treatment of other high-severity, unauthenticated Ivanti edge-device vulnerabilities.

CISA’s data lists knownRansomwareCampaignUse as “Unknown” for this CVE, meaning CISA has not confirmed ransomware operators exploiting this specific flaw at this time. No specific threat actor, intrusion set, or campaign name has been publicly attributed to exploitation of CVE-2026-104935 in the data available for this analysis. It would be inaccurate to assign responsibility to any named group based on Connect Secure’s prior exploitation history alone — that history is useful for threat-modeling and urgency, but it is not evidence of who is behind this particular CVE.

Impact Assessment

Unauthenticated arbitrary command execution on an SSL VPN gateway is a severe outcome because of what the appliance sits between and what it holds:

• Full appliance compromise: Command execution on the underlying OS of the VPN gateway gives an attacker a foothold with no prior access required, including the ability to install persistence mechanisms directly on internet-facing infrastructure.
• Credential harvesting: VPN appliances process authentication for every remote user; a compromised gateway can be used to intercept or exfiltrate credentials, session tokens, and potentially MFA-related artifacts for the entire remote workforce.
• Network perimeter bypass: Because the appliance’s purpose is to grant trusted access into the internal network, attacker control of it can be leveraged to pivot past the very perimeter the device was deployed to protect.
• Multi-factor authentication circumvention: If authentication trust decisions are made or relied upon at the appliance layer, a spoofing-based bypass can effectively sidestep MFA enforcement that depends on that trust boundary.

Sector-specific risk: Organizations using Connect Secure for remote access to regulated environments — healthcare networks, financial institutions, and government agencies — face elevated risk given the appliance’s direct line into internal systems and its history of attracting sophisticated, persistent intrusion attempts.

Affected Versions

CISA’s data does not specify exact affected version ranges for CVE-2026-104935. Ivanti’s own security advisory is the authoritative source:

Treat any Connect Secure appliance not yet updated per Ivanti’s advisory as potentially exposed.

Remediation Steps

1. Apply the Ivanti-published patch referenced in the vendor’s security advisory immediately; the CISA remediation deadline for this CVE has already passed as of this analysis’s publication.
2. Run Ivanti’s Integrity Checker Tool (ICT) against affected appliances to check for signs of prior compromise before and after patching, consistent with Ivanti’s standard guidance for its edge devices:

# Example ICT invocation pattern (exact syntax per Ivanti's documentation)
# Run internal and external ICT scans and compare results

3. If compromise is suspected, follow Ivanti’s standard incident guidance for Connect Secure appliances, which has historically included factory reset and full credential rotation rather than in-place remediation, given the difficulty of fully verifying appliance integrity after a confirmed intrusion.
4. Rotate all credentials associated with the appliance and any backend systems it authenticates against, including service accounts and certificate-based trust material.
5. Temporarily restrict internet exposure of the management interface, if operationally feasible, while patching and validation are completed.
6. Review VPN session logs for the period before patching to identify any sessions that may have been established via the bypass rather than genuine credentials.

Detection Guidance

Ivanti has not published CVE-2026-104935-specific detection signatures in the data available for this analysis; defenders should consult Ivanti’s advisory and their IDS/EDR vendor’s signature feed as updates become available. In the interim:

• Integrity Checker Tool results: Treat any ICT discrepancy as a high-confidence indicator of compromise requiring incident response, not just patching.
• Authentication anomalies: Review authentication logs for sessions established without a corresponding valid credential-based login event, which would be consistent with a spoofing-based bypass.
• Outbound connection monitoring: Edge VPN appliances should have a predictable, narrow set of legitimate outbound connections; flag any unexpected outbound traffic from the appliance itself as a potential sign of post-exploitation activity.
• Command execution artifacts: Where appliance logging permits, monitor for execution of unexpected binaries or shell commands originating from the web-facing authentication service process.

Timeline

References

• Ivanti — Security Advisory: CVE-2026-104935
• NVD — CVE-2026-104935