CVE-2026-104935 – High Authentication Bypass in Ivanti Connect Secure
A High severity authentication bypass (CWE-290) in Ivanti Connect Secure has been exploited in the wild and added to the CISA KEV. The flaw allows a remote unauthenticated attacker to bypass authentication and execute arbitrary commands, steal credentials, and exfiltrate data.
TL;DR
- Severity: High (CVSS 8.6; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
- Impact: Remote unauthenticated attacker can execute arbitrary commands and exfiltrate data.
- Affected: Ivanti Connect Secure ICS versions before 25.1.3.0.
- Action: Apply patch immediately and monitor for active exploitation.
Overview
On October 13, Ivanti Connect Secure published a security advisory for CVE-2026-104935, a High severity authentication bypass by spoofing (CWE-290). The vulnerability was added to the CISA KEV after active exploitation was reported.
The issue affects remote access security. A remote unauthenticated attacker can bypass authentication to execute arbitrary commands, steal credentials, and exfiltrate data.
Technical Details
The vulnerability is an authentication bypass by spoofing. The attacker spoofs authentication context, allowing an unauthenticated remote actor to reach privileged functionality.
One reported vector involved the X-DSCGI-PATH header. The CVSS score of 8.6 reflects high confidentiality, low integrity, and low availability impact within the assigned scope.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS 3.1 Base Score | 8.6 (High) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| CWE | CWE-290 |
| CISA KEV | Yes |
The High severity reflects a critical authentication failure that can lead to remote command execution.
Affected Products
The affected product is Ivanti Connect Secure ICS. Affected versions include releases before 25.1.3.0, according to the advisory. For the full list of affected products and versions, see CVE page.
Actionable Insights / What to Do
- Hunt for unauthenticated access patterns and authentication bypass attempts.
- Review Connect Secure logs for anomalous X-DSCGI-PATH activity or session behavior.
- Check exposed assets against CVE-2026-104935.
- Apply patch and mitigation.
For real-time threat activity and key indicators, see CVE page.
Remediation & Mitigation
- Apply the vendor patch for CVE-2026-104935.
- If patch is unavailable, apply the published mitigation.
- Follow CISA BOD 26-04 guidance for cloud services or discontinue use if mitigation is unavailable.
References
- Ivanti Connect Secure Advisory – CVE-2026-104935
- CISA Known Exploited Vulnerabilities – CVE-2026-104935
Bottom Line
CVE-2026-104935 is a High severity authentication bypass in Ivanti Connect Secure. It is CISA KEV listed and under active exploitation. Apply patch immediately.
#CVE2026104935 #Ivanti #ConnectSecure #CISAKEV #HighSeverity #AuthenticationBypass #ZeroDay #RCE