Key points
- CVE-2026-104935 is a high-severity authentication bypass in Ivanti Connect Secure versions prior to 25.1.3.0.
- The flaw allows remote, unauthenticated attackers to execute arbitrary commands on the gateway.
- Ivanti and CISA confirmed active exploitation in the wild before the October 13, 2026 disclosure.
An attacker gains the ability to run any command on an Ivanti Connect Secure gateway without needing a username or password. They needed only network access to the vulnerable device to achieve this remote code execution. This capability effectively turns the VPN gateway into a fully compromised server under attacker control.
In plain English
The vulnerability is an authentication bypass by spoofing, classified as CWE-290. It allows a remote attacker to trick the system into believing they are authenticated. Once this check is bypassed, the attacker can execute arbitrary commands on the device. The CVSS score is 8.6, rated as high severity.
The background
Ivanti published an advisory on 13 October 2026, confirming that exploitation had already occurred in the wild. A limited number of customers were affected. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on the same day. Volexity detected the threat actor activity in early October 2026.
What changes now
Vendor-supplied updates are available to remediate the issue. Affected versions include 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. Resolved versions are 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5. Versions 22.7R2.14 and earlier are not impacted by this specific flaw.
The attacker's path
Teams usually treat authentication bypasses as critical entry points for initial access. This technique relies on the target system trusting falsified identity signals. It serves the intrusion stage where an adversary establishes a foothold without credentials. Check whether your perimeter devices validate identity tokens strictly. Ensure that network segmentation limits lateral movement if a gateway is compromised. Monitor for unusual command execution patterns on edge appliances.
What to do and how to stay safe
- Inventory all Ivanti Connect Secure gateways and verify their current version numbers against the affected list.
- Apply vendor-provided updates to reach resolved versions such as 25.1.3.0 or 22.8R2.5 as soon as possible.
- Review network logs for signs of unauthorised command execution or unusual traffic patterns on VPN gateways.
- Consult the vendor’s recovery instructions if you suspect your environment has been compromised.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Ivanti Connect Secure are vulnerable to CVE-2026-104935?
Versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior are affected. Versions 22.7R2.14 and earlier are not impacted.
Has this vulnerability been exploited in real-world attacks?
Yes, Ivanti and CISA confirmed that exploitation occurred in the wild prior to the October 13, 2026 disclosure, affecting a limited number of customers.
Are there reliable indicators of compromise for this attack?
Ivanti stated at the time of the advisory that reliable indicators of compromise were not available, though V
