Vulnerabilities

Ivanti Connect Secure Authentication Bypass Added to CISA’s Known Exploited Vulnerabilities Catalogue

CVE-2026-104935 allows remote unauthenticated attackers to execute arbitrary commands via a spoofing flaw, with active exploitation already confirmed.

AI-generated illustration depicting vulnerability for the story: Ivanti Connect Secure Authentication Bypass Added to CISA's Known Exploited Vulnerabilities Catalogue

Summary

  • CISA has added CVE-2026-104935, an authentication bypass by spoofing vulnerability in Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalogue.
  • A remote, unauthenticated attacker can exploit the flaw to execute arbitrary commands — no credentials required.
  • Attackers have been observed chaining this vulnerability with other Ivanti Connect Secure flaws in active campaigns.
  • Federal agencies subject to BOD 26-04 must remediate or discontinue use by 16 October 2026; all organisations should treat this timeline as a practical benchmark.
  • Forensic triage of affected appliances is required under CISA guidance, not just patching.

What Has Been Disclosed

CISA has formally catalogued CVE-2026-104935, an authentication bypass by spoofing vulnerability affecting Ivanti Connect Secure. The vulnerability permits a remote, unauthenticated attacker to execute arbitrary commands on affected appliances. Its addition to the Known Exploited Vulnerabilities catalogue confirms that exploitation is occurring in the wild, not merely theoretical.

How Attackers Are Using It

According to reporting from The Hacker News, threat actors have been chaining this vulnerability with at least two other Ivanti Connect Secure flaws in coordinated attacks. This chaining behaviour is a meaningful signal: it suggests organised adversaries with sufficient reconnaissance to sequence multiple weaknesses for deeper access, rather than opportunistic scanning. BleepingComputer has also reported that Ivanti itself warned customers of active exploitation, indicating the vendor is aware of in-the-wild attack activity.

Why Ivanti Connect Secure Is a High-Value Target

Ivanti Connect Secure is a widely deployed SSL VPN solution used by enterprises and government agencies to provide remote access to internal networks. As a network perimeter appliance sitting at the boundary between the open internet and internal infrastructure, a vulnerability of this class carries outsized risk. Unauthenticated command execution on a gateway device can give an attacker a persistent foothold from which to pivot laterally, harvest credentials, or intercept traffic.

Regulatory and Compliance Context

CISA’s required action references BOD 26-04, which establishes risk-prioritised patching timelines and forensic triage requirements for internet-exposed assets. The remediation due date is 16 October 2026. Organisations operating in cloud environments using Ivanti Connect Secure are expected to follow applicable BOD 26-04 cloud guidance. Where mitigations are not available, CISA’s direction is unambiguous: discontinue use of the product. CISA also specifically requires stakeholders to evaluate each asset’s internet exposure as part of compliance — a step that should not be treated as administrative formality.

The Forensic Triage Requirement

A notable element of CISA’s required action is the explicit mention of forensic triage. Patching alone is insufficient if an appliance has already been compromised. Organisations should treat any internet-facing Ivanti Connect Secure deployment as potentially affected and conduct triage to determine whether indicators of compromise are present before or alongside remediation. The specific forensic requirements are detailed in CISA’s published guidance referenced in the advisory.

Why it matters

For CISOs, an unauthenticated remote code execution pathway on a VPN gateway represents one of the more serious exposure scenarios in enterprise security. Ivanti Connect Secure appliances are frequently positioned as the first layer of defence for remote access, meaning a successful exploit can bypass perimeter controls entirely. The confirmed chaining of this vulnerability with other flaws indicates capable threat actors are actively targeting these devices in structured campaigns. Organisations that have not already audited their Ivanti Connect Secure estate for internet exposure, applied available vendor mitigations, and completed forensic triage should escalate this to an immediate priority. The 16 October 2026 deadline under BOD 26-04 sets a formal floor; risk-aware organisations should be working to a shorter internal timeline.

What to do now

  • Apply all available mitigations from Ivanti in accordance with vendor instructions for CVE-2026-104935 immediately.
  • If mitigations are unavailable for your deployment, evaluate whether use of the product should be discontinued per CISA BOD 26-04 guidance.
  • Conduct forensic triage of all affected Ivanti Connect Secure appliances per CISA’s published forensic triage requirements — do not treat patching alone as sufficient.
  • Audit the internet exposure of every Ivanti Connect Secure asset in your environment and document findings to support BOD 26-04 compliance.
  • Assess whether this vulnerability has been chained with other Ivanti flaws in your environment by reviewing threat intelligence and logs for indicators of compound exploitation.
  • For cloud deployments of Ivanti Connect Secure, apply the applicable BOD 26-04 cloud guidance as directed by CISA.

Sources

Related Posts