CVE-2026-104935 · Low · CISA KEV

Ivanti Connect Secure Auth Bypass: Remote Unauthenticated Command Execution

Threat Engine Auto-Feed · data current as of 2026-10-13

CVE-2026-104935 in Ivanti Connect Secure is an authentication bypass vulnerability allowing remote, unauthenticated attackers to execute arbitrary commands. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Organizations using Ivanti Connect Secure should prioritize mitigation.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is an authentication bypass, meaning an attacker can circumvent the security measures designed to verify user identity. By spoofing, an attacker can trick the system into believing they are a legitimate user, thereby gaining unauthorized access without needing valid credentials.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Ivanti Connect Secure for remote access or VPN services
  • Financial services organizations (due to specific threat actor targeting)
  • Technology sector organizations (due to specific threat actor targeting)

Misconfigurations that escalate it

  • Any Ivanti Connect Secure instance exposed to the internet without additional protective layers or strict access controls.

High-impact scenarios

  • Complete compromise of the Ivanti Connect Secure appliance, leading to network access for an unauthenticated attacker.
  • Execution of arbitrary commands on the affected device, potentially leading to further internal network penetration.
  • Data exfiltration or deployment of ransomware by financially motivated threat actors (FIN7, LockBit affiliates, APT38).
  • Espionage or supply-chain compromise by state-sponsored actors (APT29, Scattered Spider).

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Ivanti Connect Secure logs for unusual access patterns, unauthenticated access attempts, or unexpected command executions.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic originating from or targeting Ivanti Connect Secure devices.
  • Regularly audit configurations of Ivanti Connect Secure for any unauthorized changes.

Contain

  • Isolate affected Ivanti Connect Secure appliances from the broader network if compromise is suspected.
  • Restrict network access to Ivanti Connect Secure devices to only necessary source IPs and ports.

Patch

  • Apply vendor-provided patches for Ivanti Connect Secure immediately upon availability.
  • Follow Ivanti's official security advisories and mitigation steps for CVE-2026-104935.

Frontier verdict — Low

This is a critical vulnerability in Ivanti Connect Secure, actively exploited in the wild, enabling remote unauthenticated command execution, demanding immediate attention.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.