CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Overview
Ivanti Connect Secure contains an authentication bypass flaw that allows a remote, unauthenticated attacker to execute arbitrary commands on the appliance. By sending a crafted request with spoofed authentication material, an attacker can circumvent the authentication gate entirely without credentials or user interaction. Affected versions include the 25.1 line prior to 25.1.1.2 and 25.1.3.0, and the 22.8 line prior to 22.8R2.5. Versions 22.7R2.14 and earlier are not affected. Ivanti confirmed active exploitation against a limited number of customers at the time of disclosure.
Vulnerability details
CWE-290 describes a class of flaw where a system makes an authentication or trust decision based on data that an attacker can forge. In Ivanti Connect Secure, the authentication gate accepts a crafted inbound request containing spoofed identity material, treating it as a legitimately authenticated session. The exact field or token being forged, whether a header, certificate attribute, or session indicator, is not specified in available sources. The result is that the authentication check is bypassed entirely, granting the attacker an execution context that should require valid credentials.
An attacker with network access to the ICS interface sends a crafted request carrying spoofed authentication material. No prior credentials, account access, or user interaction are required. Once the authentication gate accepts the forged request, the attacker can execute arbitrary commands on the appliance. The CVSS vector rates the confidentiality impact as high, with limited integrity and availability impact. Exploitation in the wild was confirmed at disclosure, with Volexity credited for discovery and initial indicator research.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Run Ivanti's Integrity Checker Tool against the appliance file system and compare results against a known-good baseline. Unexpected modifications to system binaries or configuration files on an unpatched appliance are a strong indicator of post-exploitation activity.
- Monitor network flows to the ICS management or VPN interface for inbound requests from unexpected source addresses, particularly those that trigger authenticated responses or session creation without a preceding credential submission.
Remediation
Additional hardening
- Upgrade Ivanti Connect Secure to 25.1.1.2, 25.1.3.0, or 22.8R2.5, depending on your current release line. Note that 25.1.3.0 requires new ISA4500, ISA6500, or ISA8500 hardware or rebuilt virtual devices; see the vendor advisory in References for migration guidance.
- Restrict network access to the ICS management and VPN interfaces to known, authorized source IP ranges using perimeter controls or an upstream firewall, reducing the attacker pool for this unauthenticated inbound attack.
- If immediate patching is not possible, isolate the appliance from general internet exposure and route access through a VPN or jump host requiring separate authentication, limiting the reachable attack surface.
- Follow Ivanti's published recovery steps and review Volexity's indicators of compromise if exploitation is suspected. Treat any unpatched internet-facing ICS appliance as potentially compromised until the Integrity Checker Tool confirms a clean state.
Key dates
References
Frequently asked questions
Does CVE-2026-104935 affect my FedRAMP authorization?
If Ivanti Connect Secure runs inside your authorization boundary, yes. CVE-2026-104935 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 16, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. At this point, you either remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-104935?
Knox does not patch your software. Remediating Ivanti Connect Secure is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is a pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that support documentation of the fix for your next assessment. Applying the patch is yours to do. Managing compliance posture while you do it is not something you have to handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-104935. Exposure surfaces during ongoing monitoring rather than waiting until an assessor flags it at review time, which means you have a clearer picture of your posture between assessment cycles.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-104935's remediation deadline of October 16, 2026 has passed. What happens now?
If CVE-2026-104935 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on stable footing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
