Full Report
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
Analysis Summary
# Vulnerability: Ivanti Connect Secure Authentication Bypass and RCE
## CVE Details
- **CVE ID:** CVE-2026-104935
- **CVSS Score:** Not explicitly listed in text, but categorized as **High** severity.
- **CWE:** Authentication Bypass (leading to Command Injection).
## Affected Systems
- **Products:** Ivanti Connect Secure (ICS) remote access gateway (formerly Pulse Connect Secure / Juniper Pulse).
- **Versions:**
- 22.8R2.4 and earlier
- 25.1.2.2 and earlier
- 25.1.1.1 and earlier
- **Configurations:** All internet-exposed ICS appliances are considered at risk (estimated 5,500+ instances globally).
## Vulnerability Description
CVE-2026-104935 is an authentication bypass vulnerability. It allows a remote, unprivileged threat actor to bypass security controls and execute arbitrary commands on the targeted ICS appliance. The flaw is significant as it requires no user interaction and serves as a direct entry point into the internal corporate network.
## Exploitation
- **Status:** Exploited in the wild (Zero-day). Ivanti reports limited targeted exploitation.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Ability to execute commands and access corporate/cloud resources).
- **Integrity:** High (Ability to modify system configurations or deploy malware).
- **Availability:** High (Potential for system takeover or service disruption).
## Remediation
### Patches
Ivanti has released security updates to address this flaw. Customers are urged to upgrade to the latest fixed versions immediately:
- **ICS Version 22.8R2.5** (or later)
- **ICS Version 25.1.2.3** (or later)
- **ICS Version 25.1.1.2** (or later)
*(Note: Users should verify specific fixed version numbers via the official Ivanti portal.)*
### Workarounds
- No specific temporary configuration workarounds were provided in the text; immediate patching is the primary recommendation.
## Detection
- **Indicators of Compromise:** Users should monitor for unauthorized command execution or unusual administrative activity.
- **Detection Methods and Tools:**
- **Integrity Checker Tool:** Ivanti recommends running their built-in Integrity Checker Tool regularly to identify unauthorized file system modifications.
- **Log Analysis:** Review logs for bypass attempts or unexpected remote access sessions.
## References
- **Vendor Advisory:** hxxps[://]hub[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- **Ivanti Blog:** hxxps[://]www[.]ivanti[.]com/blog/october-2026-security-update
- **Threat Monitoring:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?date_range=7&vendor=pulse+secure&type=vpn&model=pulse+connect+secure+vpn&group_by=geo&stacking=stacked