Frequently Asked Questions About the Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

What it is

CVE-2026-104935 is an authentication bypass by spoofing in Ivanti Connect Secure. A remote attacker forges the signals the appliance uses to confirm identity, so a forged request is treated as coming from a trusted, logged-in user. The attacker can then run arbitrary commands without any credential. Ivanti says the bypass uses a path separate from normal authentication, so existing login protections do not stop it. The vendor and CISA report exploitation in the wild, and CISA added the CVE to the KEV catalog on 13 October 2026.

Preconditions / Affected

Which fix applies depends on the appliance hardware:

• ISA6000 or ISA8000 running 25.1.1.1 or earlier.
• ISA4500, ISA6500 or ISA8500 running 25.1.2.2 or earlier.
• Any appliance on the 22.8.X branch up to 22.8R2.4. Ivanti describes this branch as a temporary bridge to the 25.1 line.
• Versions 22.7.X and earlier, including 22.7R2.14, are not affected.

flowchart TD
    A[Identify branch and hardware] --> B{Platform}
    B -->|ISA6000 / ISA8000| C[25.1.1.2]
    B -->|ISA4500 / ISA6500 / ISA8500| D[25.1.3.0 or 25.1.3.1]
    B -->|22.8.X branch| E[22.8R2.5, or move to 25.1]

What to do

1. Preserve logs, configuration backups and system images from each affected appliance before changing anything.
2. Record the branch and hardware platform of every Connect Secure appliance.
3. Install the matching fixed version: 25.1.1.2 for ISA6000 and ISA8000, 25.1.3.0 or 25.1.3.1 for ISA4500, ISA6500 and ISA8500, and 22.8R2.5 for the 22.8.X branch.
4. Update first if you run 25.1.1.1 on ISA6000 or ISA8000, or any 22.8.X version. Ivanti recommends going directly to 25.1.1.2 or later instead of relying on the interim 22.8R2.5. Use 22.8R2.5 only when moving to 25.1 immediately is not possible.
5. If compromise is suspected, follow Ivanti's published recovery guidance and contact Ivanti support.

Caveats

• Ivanti describes no workaround, so patching is the only remedy.
• Ivanti has published no reliable indicators of compromise, so a clean check does not show an appliance is unaffected. Preserving evidence before patching matters for that reason.
• Ivanti says it found part of the flaw through its own product security program and fixed that portion in the July 2026 release, 25.1.3.0. Volexity is credited with helping protect customers.
• The page says ransomware gangs and APT groups have historically exploited such Ivanti flaws. It names no actor for this CVE.