Full Report
A vulnerability has been discovered in Ivanti Connect Secure (ICS) that could allow for arbitrary code execution. Ivanti Connect Secure is an enterprise-grade SSL VPN and zero-trust remote access gateway. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands.
Analysis Summary
# Vulnerability: Ivanti Connect Secure Authentication Bypass and Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** 10.0 (Critical) - *Estimated based on unauthenticated RCE description*
- **CWE:** CWE-290 (Authentication Bypass by Spoofing) / CWE-77 (Command Injection)
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS) - Formerly Pulse Connect Secure
- **Versions:**
- ICS 25.1.1.1 and prior
- ICS 25.1.2.2 and prior
- ICS 22.8R2.4 and prior
- **Configurations:** Systems running versions newer than 22.7R2.14 are primarily affected; versions 22.7R2.14 and prior are noted as not impacted.
## Vulnerability Description
CVE-2026-104935 is an authentication bypass vulnerability caused by spoofing. A remote, unauthenticated attacker can bypass security controls to gain unauthorized access to the gateway. Once the bypass is achieved, the flaw allows for the execution of arbitrary commands (RCE) in the context of the system. This enables attackers to install malicious programs, modify sensitive data, or delete system files.
## Exploitation
- **Status:** **Exploited in the wild.** Active exploitation reported by Ivanti and Volexity.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to system data and potential VPN traffic)
- **Integrity:** High (Ability to modify system configuration and install backdoors)
- **Availability:** High (Potential for system deletion or service disruption)
## Remediation
### Patches
Ivanti has released the following fixed versions. It is recommended to apply these immediately:
- **ICS 25.1.1.2**
- **ICS 25.1.3.0 / 25.1.3.1**
- **ICS 22.8R2.5** (Note: Ivanti recommends users on 22.8 migrate to 25.1.1.2+ as the 22.x branch reaches EOL on Jan 31, 2027).
### Workarounds
- No specific software workaround (such as XML mitigation) is listed in the advisory; **immediate patching** is the primary recommendation.
- Implement the Principle of Least Privilege (PoLP) and restrict network access to the management interface.
## Detection
- **Indicators of Compromise:** Monitor for unusual administrative activity, unexpected command execution in system logs, or unauthorized modifications to system files.
- **Detection methods and tools:**
- Perform automated vulnerability scans using SCAP-compliant tools.
- Conduct external penetration testing to verify the exposure of the ICS gateway.
- Reference Volexity’s blog for specific forensic indicators related to unauthenticated event chains.
## References
- **Vendor Advisory:** hxxps://hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- **CVE Record:** hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-104935
- **Volexity Research:** hxxps://www[.]volexity[.]com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/