What is CVE-2026-104935?
CVE-2026-104935 is an Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure. It lets a remote attacker forge the signals the device uses to confirm a user’s identity, so the device treats a forged request as if it came from a trusted, already logged-in user.
Once past the login check, the attacker can run arbitrary commands on the Ivanti Connect Secure appliance without providing a username, password, or any other credential. Ivanti states this bypass uses a path separate from normal authentication, so existing login protections do not stop it.
| CVE | Description | CVSS | Exploited in the wild |
|---|---|---|---|
| CVE-2026-104935 | Authentication Bypass by Spoofing in Ivanti Connect Secure | Not yet scored | Yes |
Is CVE-2026-104935 being exploited in the wild?
CVE-2026-104935 is being exploited in the wild, as reported by the vendor and CISA, which added it to its Known Exploited Vulnerabilities catalog on October 13, 2026.
How did CVE-2026-104935 come to light?
Ivanti states it discovered part of this vulnerability through its own product security program and fixed that portion in the July 2026 release, version 25.1.3.0, then worked to backport the fix to other supported versions. Volexity is credited with helping protect Ivanti customers, and the advisory was published on October 13, 2026.
How is watchTowr helping Ivanti Connect Secure customers?
- Adversary Sight engine identified Ivanti Connect Secure instances across client environments and assessed exposure.
- Rapid Reaction identified exposure to this vulnerability across the watchTowr client base, giving teams the time they need to act.
What is Ivanti Connect Secure?
Ivanti Connect Secure is a remote access product that organizations use to let employees and partners connect securely to internal applications and network resources, commonly serving as a VPN gateway at the network edge.
Which Ivanti Connect Secure versions are affected?
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Ivanti Connect Secure (ISA6000 or ISA8000) | 25.1.1.1 and prior | 25.1.1.2 |
| Ivanti Connect Secure (ISA4500, ISA6500, or ISA8500) | 25.1.2.2 and prior | 25.1.3.0, 25.1.3.1 |
| Ivanti Connect Secure 22.8.X branch | 22.8R2.4 and prior | 22.8R2.5 |
- Ivanti states that versions 22.7.X and earlier, including 22.7R2.14, do not contain this vulnerability.
- The 25.1.1.1 and earlier branch affects devices running on ISA6000 or ISA8000 hardware.
- The 25.1.2.2 and earlier branch affects devices running on ISA4500, ISA6500, or ISA8500 hardware.
- The 22.8.X branch, up to 22.8R2.4, is also affected and is meant only as a temporary bridge to the 25.1 line.
Organizations running Ivanti Connect Secure 25.1.1.1 on ISA6000 or ISA8000 hardware, or the 22.8.X branch, should update first, since Ivanti recommends moving directly to 25.1.1.2 or later rather than relying on the interim 22.8R2.5 release.
How do I fix CVE-2026-104935?
Ivanti has released fixed versions for every affected branch: 25.1.1.2 for ISA6000 and ISA8000 devices, 25.1.3.0 or 25.1.3.1 for ISA4500, ISA6500, and ISA8500 devices, and 22.8R2.5 for the 22.8.X branch. Ivanti does not describe a workaround, so installing the matching fixed version is the only remedy.
- Preserve logs, configuration backups, and system images from affected Ivanti Connect Secure devices before making changes.
- Check devices for signs of compromise, noting that Ivanti has not published reliable indicators of compromise.
- Follow Ivanti’s published recovery guidance if compromise is suspected, and contact Ivanti support for assistance.
- Identify the branch and hardware platform of each Ivanti Connect Secure appliance in use.
- Update ISA6000 or ISA8000 devices to version 25.1.1.2, or ISA4500, ISA6500, or ISA8500 devices to 25.1.3.0 or 25.1.3.1.
- Update 22.8.X branch devices to 22.8R2.5 if moving to 25.1 immediately is not possible.
How do I check Ivanti Connect Secure for compromise?
Ivanti states that no reliable indicators of compromise are available for this vulnerability at this time. Organizations that suspect an Ivanti Connect Secure device was compromised should follow Ivanti’s published recovery steps and work directly with Ivanti support to investigate.
What types of threat actors typically exploit this vulnerability?
Historically, ransomware gangs and APT groups exploit these vulnerabilities.
Have there been similar Ivanti Connect Secure vulnerabilities before?
Yes. These earlier Ivanti Connect Secure vulnerabilities were added to the CISA KEV catalog after exploitation in the wild:
| CVE | Description | Added to KEV |
|---|---|---|
| CVE-2025-22457 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | April 4, 2025 |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | January 8, 2025 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | January 31, 2024 |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | January 10, 2024 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | January 10, 2024 |
| CVE-2021-22893 | Ivanti Pulse Connect Secure Use-After-Free Vulnerability | November 3, 2021 |
| CVE-2020-8243 | Ivanti Pulse Connect Secure Code Execution Vulnerability | November 3, 2021 |
| CVE-2021-22900 | Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | November 3, 2021 |
