ZeroDayAlert

CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

Ivanti Connect Secure Added to KEV 2026-10-13 Federal due 2026-10-16 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Ivanti Connect Secure is a remote access gateway commonly deployed in enterprise networks to provide VPN and secure connectivity. This vulnerability allows an unauthenticated attacker to bypass authentication and run arbitrary commands on affected instances, regardless of whether the gateway faces the internet or sits behind a firewall. The record does not specify which versions of Connect Secure are affected or what fixes are available.

How to check whether this touches you

  • Inventory Connect Secure appliances across your organisation, including those in production, test, and disaster recovery environments.
  • Establish whether each instance is reachable from outside your network perimeter (via internet, partner connections, or cloud hosting), as the attack requires only network access.
  • Query the running version number through the administrative interface or API; note that patch history is not publicly stated in this record, so a version alone is a signal but not proof of vulnerability status.
  • If you operate a cloud service or SaaS instance that uses Connect Secure, treat it under the same reachability and patching requirements as on-premises deployments.

What to do

  1. Immediately contact Ivanti support to obtain the current mitigation or patch guidance for your specific version; do not assume a patch exists until confirmed.
  2. Prioritise patching or mitigation for any Connect Secure instance reachable from outside your network, in line with CISA BOD 26-04 guidance (due date 16 October 2026 for federal systems).
  3. If patching cannot be applied before the due date, implement network segmentation to restrict access to the gateway to known, authorised sources only, and increase monitoring for suspicious authentication attempts and command execution.
  4. Enable and centralise all authentication logs, session logs, and command audit trails; configure alerting for failed authentication attempts followed by successful access, which may indicate spoofing.
  5. If mitigations cannot be put in place and the product remains unpatched, escalate to your information security team and business owner to evaluate discontinuation under BOD 26-04 requirements.

If you find you were exposed

Exploitation of an authentication bypass typically occurs before public disclosure, so review logs and network recordings from at least 90 days before the public announcement. Focus on session logs and command histories to identify any lateral movement, data exfiltration, or persistence mechanisms left behind. If your log retention is shorter than that window, note the gap and ensure future retention meets forensic investigation requirements as outlined in CISA's "Forensics Triage Requirements" guidance.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-104935 is being exploited. It cannot tell you whether Connect Secure is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →