Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

What it is

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure (CVSS 3.1 score 8.6). A remote attacker can run arbitrary commands on the appliance without logging in. Ivanti and CISA report exploitation in the wild, and CISA added it to KEV on 13 October 2026. Ivanti credits Volexity with the report.

Preconditions / Affected

Network access to the product is enough. Ivanti's advisory describes no extra configuration requirement, and no valid account is needed.

• Not affected: 22.7.X and earlier.
• Affected: the 22.8.X bridge release, 25.1.1.1 on ISA6000 and ISA8000 hardware, and 25.1.2.2 and earlier builds.
• Highest priority: anything on 22.8.X or on a version before 25.1.3.0. Ivanti had not finished backporting the fix to those lines when it published the advisory. It had already fixed part of the issue in the July 25.1.3.0 release.

What to do

1. Before changing anything, preserve logs and system images from affected appliances.
2. Update to the fixed version for your branch: 22.8R2.5, 25.1.1.2, 25.1.3.0 or 25.1.3.1.
3. Restrict network access to the management and gateway interfaces where possible.
4. Check for compromise using Ivanti's recovery guidance. No reliable indicators of compromise exist, so a scan or signature will not settle the question.
5. Plan to move off the 22.7 and 22.8 lines before their end of life on 31 January 2027.

Caveats

• Moving to 25.1.3.0 requires new ISA4500, ISA6500 or ISA8500 hardware, or a rebuilt virtual or cloud appliance from the new template. Teams not ready for that can take the interim fixes, 22.8R2.5 or 25.1.1.2.
• The page does not explain the spoofing mechanism or the exploit path.
• It does not reconcile why 25.1.1.2 is listed as a fix while 25.1.2.2 and earlier are listed as affected. Check Ivanti's advisory for the exact per-branch boundary.
• The rest of the page describes watchTowr's exposure-detection service and adds no technical detail.