Ivanti Connect Secure auth bypass added to CISA KEV (CVE-2026-104935)
At a glance
| Severity | CRITICAL |
|---|---|
| In CISA KEV (exploited) | Yes, due 2026-10-16 |
| Vendor | Ivanti |
| CVE IDs | CVE-2026-104935 |
CISA has added an Ivanti Connect Secure authentication bypass, tracked as CVE-2026-104935, to its Known Exploited Vulnerabilities (KEV) catalog, which means it is being exploited in the wild. According to the CISA KEV entry, a remote, unauthenticated attacker can use the flaw to run arbitrary commands. Federal agencies must act by 16 October 2026, and every other Ivanti Connect Secure operator should treat that date as their own.
What happened
On 13 October 2026 CISA listed the flaw under the name “Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability”. The catalog describes it as an authentication bypass by spoofing: the attacker pretends to be a legitimate party and skips the login checks, which then allows command execution on the appliance.
CISA has not stated how the exploitation was observed, who is behind it, or how many organisations are affected. Those details are not disclosed in the entry. CISA also lists the known ransomware campaign use as “Unknown”.
Am I affected?
- Product: Ivanti Connect Secure, the vendor’s remote access VPN gateway.
- Affected versions: not disclosed in the KEV entry. Check the vendor advisory and the NVD record for the exact builds.
- Exposure: any appliance reachable from the internet should be assumed at risk. CISA tells stakeholders to evaluate each asset’s internet exposure.
Why this matters
Analysis, not new facts: a VPN gateway sits at the network edge, is reachable by design and often holds credentials and session data for the whole workforce. An unauthenticated command execution bug on such a device gives an attacker a foothold that bypasses endpoint controls. Because the flaw is in KEV, you should patch or mitigate within hours rather than waiting for the next maintenance window.
How to prioritise this fix
Analysis, not new facts: rank appliances by exposure first. Internet-facing gateways that serve remote staff come before internal or lab units. Next, rank by what the appliance can reach: a gateway with access to flat internal networks or privileged systems deserves earlier attention. If you cannot apply the mitigations before the deadline, restrict management and user access to the appliance as far as your business allows, and monitor it closely until you can. Document any exception and who approved it.
Technical details
- CVE: CVE-2026-104935
- Type: authentication bypass by spoofing, leading to arbitrary command execution
- Attack vector: remote, no authentication required
- KEV date added: 2026-10-13
- KEV due date: 2026-10-16
- Known ransomware use: unknown
- EPSS and CVSS: not available in the data we reviewed
Detection and hunting ideas
No indicators of compromise have been published, so do not rely on signature matching. These steps follow from the nature of the flaw:
- Review appliance authentication logs for successful sessions that lack a matching login event or that come from unexpected sources.
- Look for unexpected processes, new files or changed configuration on the appliance.
- Check for outbound connections from the appliance to hosts it does not normally contact.
- CISA’s required action refers to its forensics triage requirements. Follow them if you suspect compromise.
What to do
- Identify every Ivanti Connect Secure appliance, including test and forgotten ones, and note which are internet facing.
- Apply the mitigations in the vendor’s instructions. CISA’s required action says to follow the vendor guidance and the applicable binding directive for cloud services, or to discontinue use of the product if mitigations are unavailable.
- Finish by the CISA due date of 16 October 2026 at the latest. Do it sooner for exposed appliances.
- Hunt for signs of earlier compromise using the ideas above, and preserve logs before making changes where you can.
- If you find evidence of compromise, treat credentials and secrets that passed through the appliance as exposed and rotate them.
- Tell your incident response and network teams, and record the exposure decision for each appliance.
