CVE-2026-104935

Executive Summary

CVE-2026-104935 is a remote, unauthenticated authentication-bypass vulnerability in Ivanti Connect Secure (ICS) caused by spoofing, categorized as CWE-290 (Authentication Bypass by Spoofing), affecting ICS versions prior to 25.1.3.0 while explicitly not impacting 22.7R2.14 or prior. A remote attacker requiring no credentials or user interaction can exploit this flaw to execute arbitrary commands, yielding high confidentiality impact with lower integrity and availability impact (CVSS 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). The vulnerability is listed in CISA KEV with a remediation deadline of 2026-10-16, indicating confirmed real-world exploitation and elevating it to emergency patching priority for any internet-facing ICS deployment.

Technical Analysis

The core defect is an authentication bypass by spoofing (CWE-290). In this class of flaw, a system makes an authentication or trust decision based on an identity assertion, token, header, source attribute, or certificate field that an attacker can forge or replay, rather than on a value that is cryptographically bound to the legitimate party. Because the trust anchor can be impersonated, the victim system grants access to protected functionality without a valid credential exchange.

In Ivanti Connect Secure, the attack surface is the internet-facing secure access gateway. These appliances terminate VPN and remote-access sessions for untrusted networks and expose a login and pre-authentication workflow to the public internet. Per the NVD description, exploitation is fully remote and pre-authentication ("remote unauthenticated attacker"), requires no user interaction, and results in "arbitrary commands" execution. The "before version 25.1.3.0" affected-range statement, combined with the explicit carve-out for "22.7R2.14 or prior," indicates the vulnerable logic was introduced in the 25.1.x line and remediated in 25.1.3.0; the 22.7 release train is not affected. That versioning pattern is consistent with a trust-check or spoofed-identity validation path newly present in the 25.1.x branch rather than a long-standing legacy component.

The precise spoofed attribute, the internal trust-decision function, and the command-execution path are not disclosed in the available NVD description or CNA title. No specific function names, endpoints, or API parameters have been published in the source data provided, and no public proof-of-concept code or Nuclei template is available. Any lower-level reconstruction would be speculative. What can be stated with confidence is the vulnerability class and mechanism: a spoofable identity or trust assertion is accepted by ICS, collapsing authentication and giving the attacker the standing of an authenticated session, from which arbitrary commands can be executed.

The CVSS vector indicates network reachability (AV:N), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), with scope unchanged (S:U). The subscore asymmetry (C:H, I:L, A:L) is consistent with an attacker whose primary objective is data theft or credential/secret access, with only limited write or denial effects — a profile frequently observed when an authentication bypass is chained into command execution for reconnaissance, credential harvesting, or tunneling.

Exploitation Scenarios

No public PoC is available in the data provided; the following chain is inferred from the CWE-290 vulnerability class and the NVD description, not from disclosed exploit code.

1. Reconnaissance / target identification. An attacker performs internet-wide scanning for exposed Ivanti Connect Secure portals, using certificate and HTML fingerprints (see Shodan dorks). Because the flaw is pre-authentication, no valid account or prior foothold is required. Targets of interest are 25.1.x ICS deployments, which are identifiable via exposed login portals and version banners where present.

2. Triggering the spoofing flaw. The attacker sends a crafted request that presents a forged or spoofed identity/trust assertion. In the CWE-290 class, this typically means supplying a spoofable token, header, source-identity attribute, or certificate-derived field that the appliance accepts as proof of an authenticated principal. The appliance fails to cryptographically validate the assertion against its origin and treats the attacker as authenticated. The exact request structure is not disclosed in the source data.

3. Execution method. Having bypassed authentication, the attacker reaches functionality that is normally restricted to authenticated administrators or system context and leverages it to execute arbitrary commands. The NVD description confirms command execution as the outcome but does not specify the underlying interface, so no specific payload format is asserted here.

4. Post-exploitation impact. Because the CVSS confidentiality subscore is High, subsequent activity is likely to include extraction of configuration data, credentials, and secrets held by the appliance, followed by lateral movement or deployment of additional tooling. The appliance's position at the network edge makes it a high-value pivot point: a compromised ICS can expose internal session traffic and provide durable access to the corporate network.

Exploitation primitives to expect from real-world use of this flaw (authentication bypass plus arbitrary command execution) include: high-volume, automated scanning of ICS portals; attempts to retrieve or modify device configuration; credential and session harvesting; and persistent access establishment. Because the flaw is in CISA KEV, defenders should assume active exploitation in the wild against exposed, unpatched 25.1.x appliances.

Impact Assessment

Business impact is severe. Ivanti Connect Secure is an edge security appliance positioned between the internet and internal resources; compromise of the appliance can undermine the confidentiality of all remote-access sessions it brokers. The CVSS base score of 8.6 reflects a high severity with network reachability, no authentication, and no user interaction required.

Affected systems are ICS instances running versions prior to 25.1.3.0, with 22.7R2.14 and prior explicitly not impacted. Any ICS appliance exposed to the internet that is running an affected 25.1.x build should be treated as vulnerable and potentially compromised.

Blast radius is determined by the confidentiality impact (High): credentials, tokens, and configuration data passing through or stored on the appliance could be exposed, enabling secondary compromises. The Integrity and Availability subscores are Low, meaning the immediate direct effect on data modification and service availability is limited relative to the confidentiality loss, though arbitrary command execution can be chained to escalate either. With no public exploit tooling and no patch evidence, the practical risk is dominated by targeted and opportunistic exploitation of exposed appliances, and the CISA KEV listing (remediate by 2026-10-16) confirms that this risk has materialized for some organizations.

Detection Guidance

Sigma Rule

title: Ivanti Connect Secure Authentication Bypass via Spoofing (CVE-2026-104935)
id: 3f6c9d1a-7b2e-4c58-9a11-8d4f5e0c2a77
status: experimental
description: Detects signs of authentication bypass / spoofed identity acceptance against Ivanti Connect Secure, followed by command execution activity.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104935
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.104935
logsource:
  product: ivanti
  service: connect_secure
detection:
  selection_auth:
    - 'event.category: "authentication"'
    - 'authentication.outcome: "success"'
    - 'source.ip: "*"'
    - 'user.name: "admin"'
  filter_internal:
    source.ip:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_auth and not filter_internal
falsepositives:
  - Legitimate administrative logins from external IPs
level: high

YARA Rule

rule CVE_2026_104935_Ivanti_ICS_AuthBypass
{
    meta:
        description = "Detects Ivanti Connect Secure artifacts consistent with authentication bypass via spoofing (CVE-2026-104935)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104935"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "Ivanti Connect Secure"
        $b = "authentication bypass" nocase
        $c = "spoof" nocase
        $d = "25.1.3.0"
        $e = "22.7R2.14"
        $f = "/bin/sh" ascii
        $g = "cat /etc/passwd" ascii

    condition:
        uint16(0) == 0x5A4D or
        ($a and 1 of ($b, $c)) or
        ($d or $e) and 1 of ($f, $g)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104935 Ivanti Connect Secure Authentication Bypass via Spoofing - Possible Exploit Attempt"; flow:established,to_server; content:"POST"; http_method; content:"Ivanti"; http_header; nocase; classtype:attempted-admin; reference:cve,2026-104935; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104935; metadata:affected_product Ivanti_Connect_Secure, attack_target Server, deployment Perimeter, signature_severity Major; sid:2026104935; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      url.path : "*" and
      destination.port == 443 ]
  [ authentication where event.outcome == "success" and
      user.name : "admin" and
      not source.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") ]

Splunk SPL Query

index=ivanti OR index=network
| search (sourcetype=ivanti:connect_secure OR sourcetype=pan:traffic)
| where (http_method="POST" AND status="success") OR (event_type="authentication" AND outcome="success")
| stats count min(_time) as firstTime max(_time) as lastTime values(url) as urls values(src_ip) as src_ips by dest_ip user
| where count > 5
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="ivanti,connect_secure,cve-2026-104935,">
  <rule id="104935" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.category">authentication</field>
    <field name="authentication.outcome">success</field>
    <field name="user.name">admin</field>
    <description>CVE-2026-104935: Possible Ivanti Connect Secure authentication bypass via spoofing - successful admin authentication from untrusted source</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references 25.1.3.0 as the fixed version, but no vendor advisory, patch source, or workaround has been confirmed by tracked data. Treat all mitigations as compensating controls until vendor confirmation.

1. Immediate mitigations.

   • Identify all internet-facing Ivanti Connect Secure appliances and determine whether they run the 25.1.x line; version 22.7R2.14 and prior are stated as not impacted.
   • Restrict external exposure of ICS portals where operationally feasible (allowlist source IPs, place behind an access broker, or limit to known remote-user ranges) to reduce the pre-authentication attack surface.
   • Enforce MFA and monitor administrative and remote-access sessions for success events from unexpected geographies or IPs.
   • Hunt for evidence of compromise on affected appliances: unexpected configuration changes, new administrative accounts, anomalous command execution, and outbound connections to unfamiliar destinations.
   • Since the flaw yields arbitrary command execution, treat any exposed affected appliance as a potential compromise and perform forensic validation rather than assuming only unauthorized login.

2. Patch/upgrade steps.

   • Upgrade to ICS 25.1.3.0 or later. Verify the target build against the vendor's official release listing before and after upgrade.
   • Because CISA KEV sets a remediation deadline of 2026-10-16, prioritize affected externally reachable appliances for immediate upgrade and schedule remaining instances within the mandated window.
   • After upgrade, rotate credentials and secrets on or transiting the appliance, since high-confidentiality impact implies potential secret exposure.
   • No vendor fix or workaround is confirmed in the tracked source data; obtain the authoritative advisory from Ivanti before executing changes.

3. Long-term hardening.

   • Maintain an inventory of edge appliances with version tracking and automated alerting when unsupported or vulnerable builds are detected.
   • Subscribe to CISA KEV and vendor advisories; drive emergency change processes directly from KEV listings.
   • Reduce reliance on perimeter appliances as the sole trust boundary; segment internal networks so a compromised ICS cannot freely pivot.
   • Centralize authentication logs from all ICS appliances into the SIEM to support the detections above, and baseline normal authentication patterns to distinguish spoofed-identity access.

References

• NVD — CVE-2026-104935: https://nvd.nist.gov/vuln/detail/CVE-2026-104935
• CISA Known Exploited Vulnerabilities Catalog (Ivanti Connect Secure Authentication Bypass by Spoofing, remediate by 2026-10-16): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Ivanti Security Advisories (vendor advisory portal; consult for the authoritative ICS 25.1.3.0 release): https://www.ivanti.com/security-advisories

Exploitation evidence: The vulnerability is listed in CISA KEV with a remediation deadline of 2026-10-16, which indicates confirmed exploitation in the wild. No specific threat actor campaign, public PoC, or exploit code is identified in the data provided.