Ivanti Connect Secure Spoofing Flaw Enables Unauthenticated Command Execution

Ivanti Connect Secure gateways face immediate risk from CVE-2026-104935, a high-severity authentication bypass that enables remote command execution. The flaw affects versions prior to 25.1.3.0 and was actively exploited as a zero-day before vendor disclosure. Security teams must verify their appliance versions immediately to determine exposure to this unauthenticated access vector.

The risk

The vulnerability, classified as CWE-290, permits attackers to bypass authentication by spoofing credentials. According to the National Vulnerability Database, the flaw carries a CVSS score of 8.6. This rating reflects low attack complexity and high impact on confidentiality. Remote attackers can execute arbitrary commands on the device without needing valid login credentials or user interaction.

Who is exposed

Ivanti confirmed that exploitation affected a limited number of customers prior to the October 13, 2026 advisory. Affected releases include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Versions in the 22.7 branch and lower are not vulnerable. Resolved versions include 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5.

Cost and compliance

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026. The agency set a federal due date of October 16, 2026. Stakeholders must apply mitigations in accordance with vendor instructions and CISA’s BOD 26-04 guidance. Organizations should evaluate internet exposure and ensure adherence to patching guidelines for cloud services or discontinue use if mitigations are unavailable.

What to watch

Ivanti stated that reliable indicators of compromise are not available. However, the digital forensics firm Volexity published details on threat actor activity detected in early October 2026. Volexity noted that attackers also leveraged an unpatched privilege escalation vulnerability. Teams should monitor for unusual command execution on edge devices.

Signals worth monitoring

Security operations teams should examine authentication logs for failed login attempts followed by successful administrative actions without preceding user interaction. Look for unexpected outbound connections from VPN gateways to unfamiliar IP addresses. Check for new user accounts or modified system configurations created outside of standard maintenance windows. If anomalies appear, isolate the affected appliance from the network immediately to prevent lateral movement. Review firewall logs for traffic patterns consistent with command-and-control communications.

Background: Indicators of attack

Indicators of attack (IOAs) detect malicious actions as they happen, unlike static indicators of compromise (IOCs) that only confirm past infections. By monitoring for specific behaviors like unusual process spawning or credential dumping, you can stop an intrusion before the attacker achieves their objective.

Read the full guide: Indicators of Attack Explained: Why Behavior Beats Artifacts

What to do and how to stay safe

• Inventory all Ivanti Connect Secure appliances and compare their versions against the list of affected releases provided by the vendor.
• Apply the appropriate vendor update to remediate CVE-2026-104935 on any systems running vulnerable versions.
• Monitor network traffic from VPN gateways for unusual outbound connections or data exfiltration attempts.
• Review system logs for signs of unauthorized command execution or privilege escalation activity.

Step-by-step guide: Authentication Bypass Mistakes That Leave Systems Exposed

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is Ivanti Connect Secure version 22.7 vulnerable to CVE-2026-104935?

No, versions in the 22.7