Ivanti Connect Secure Authentication Bypass Vulnerability (CVE-2026-104935)

An authentication bypass flaw in Ivanti Connect Secure, tracked as CVE-2026-104935, allows remote, unauthenticated attackers to spoof trusted identities and execute arbitrary commands on vulnerable network appliances. Perimeter appliances serving as SSL VPN gateways remain primary targets for initial access operations. Given the severity of remote perimeter exposure, enterprise security teams must prioritize patching this Ivanti Connect Secure vulnerability before automated exploitation campaigns broaden.

Technical Analysis and Exploitation Path

Classified under CWE-290 (Authentication Bypass by Spoofing), this vulnerability stems from improper validation of client-supplied headers or identity tokens. In practice, an unauthenticated attacker on the network can craft specific requests that simulate legitimate internal trusted components or administrative sessions.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) underscores the low barrier to entry: the flaw is network-reachable, requires no existing privileges, low attack complexity, and zero user interaction. Once authentication is subverted, the vulnerability opens a path for remote arbitrary command execution within the appliance environment. Because SSL VPN appliances run specialized Linux distributions directly exposed to the internet, achieving command execution on the host allows attackers to pivot into internal networks, capture active session tokens, or attempt credential dumping against connected Active Directory or SAML identity providers.

Threat Landscape and EPSS Metrics

Edge gateways represent a unique defensive challenge because standard endpoint detection and response (EDR) agents cannot be installed on proprietary appliance firmware. Threat actors frequently exploit this visibility gap to establish persistence via webshells or modified system binaries.

The measured threat metrics reflect this immediate danger. The vulnerability holds an EPSS probability score of 26.0%, placing it in the 98th percentile of all tracked CVEs for likelihood of exploitation within a 30-day window. When a zero-interaction, unauthenticated perimeter bypass reaches this tier of EPSS probability, weaponized exploit code and mass internet scanning are typically active or imminent.

Affected Versions and Remediation

Ivanti has released updates across affected software branches. System administrators must inspect their running versions and apply the appropriate build:

• Ivanti Connect Secure 25.1.0.x / 25.1.1.x: Upgrade to version 25.1.1.2 or higher.
• Ivanti Connect Secure 25.1.2.x: Upgrade to version 25.1.3.0 or higher.
• Ivanti Connect Secure 22.8: Apply vendor-provided mitigations or branch patches per Ivanti Security Advisory guidance.

Because threat actors routinely attempt to establish persistence on appliance filesystems prior to patch application, applying the update alone may not clear an active intrusion. Organizations should execute standard forensic triage and run the Ivanti Integrity Checker Tool (ICT) both before and after applying the update. Federal civillian entities and organizations adhering to CISA BOD 26-04 guidance are required to apply mitigations or discontinue use of exposed, unpatched appliances by October 16, 2026. Any gateway instance that cannot be patched or verified as uncompromised should be immediately isolated from public internet exposure.