CVE-2026-104935 is an authentication bypass by spoofing vulnerability in Ivanti Connect Secure. CISA added it to the Known Exploited Vulnerabilities catalogue on 13 October 2026, which means attackers have used it in real attacks. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
What an authentication bypass by spoofing means in an edge appliance
An authentication bypass by spoofing means the device can be tricked into accepting a forged identity signal instead of proving who is really connecting. In a remote access appliance, that can turn a perimeter control into an entry point for unauthenticated command execution.
That matters because these systems often sit in front of internal networks and trusted workflows. When spoofing defeats the login boundary, the attacker is no longer limited to probing the edge, they can use the appliance itself as a bridge into protected environments.
Why this class of vulnerability is dangerous
Authentication bypass vulnerabilities are high-impact because they remove the control that separates anonymous internet traffic from trusted administrative or user access. If the appliance is exposed externally, a weakness in the trust check can be reached without prior foothold, stolen credentials, or interactive approval.
For remote access products, the danger is compounded by the fact that they often handle sessions, gateways, tunnelling, and access to internal services. A successful bypass can therefore become a direct path to command execution, configuration tampering, credential theft, or follow-on lateral movement.
How organisations check exposure and confirm risk
Start with asset inventory and ask where Ivanti Connect Secure is deployed, whether instances are internet-facing, and which business functions depend on them. Then compare those assets with the vendor advisory and the CVE Program record and NIST National Vulnerability Database entry for version-specific guidance.
Exposure review should also include whether the device is used by privileged administrators, third parties, or high-value remote workers, since compromise of those paths can have disproportionate impact. Where the appliance is externally reachable, treat it as priority infrastructure for validation and monitoring.
Remediation, detection, and post-patch review
Remediation should follow the vendor advisory and CISA KEV catalogue rather than relying on generic patch timing. If patching is delayed, reduce exposure by restricting internet reachability, tightening administrative access, and increasing monitoring around the appliance and any systems it brokers.
Detection should focus on signs of unauthorised appliance access, unexpected configuration changes, abnormal command execution, and unusual authentication or session activity. A compromise review should also look for credential, token, or session theft, because edge-device exploitation often leaves identity material behind even when the original bug is fixed.
For a practical threat perspective, compare this case with other exploited remote access products such as Ivanti Connect Secure exploitation 2024 and CitrixBleed 2 2025, which show how edge compromise can quickly become session or credential abuse.
Risk and Threat Considerations
This vulnerability is especially risky because it affects an internet-reachable trust boundary that attackers can probe at scale. Once spoofing bypasses authentication, the attacker may be able to execute commands, harvest secrets, or pivot through the appliance without ever presenting valid user credentials.
Failure mechanism: The appliance accepts a forged or insufficiently validated identity signal, so the authentication decision is made on trust of the spoofed input rather than on proof of identity.
Impact: The attacker can gain unauthenticated access to a high-value remote access control point, which can lead to command execution, session abuse, credential exposure, and downstream internal compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST SP 800-57 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Remote access auth bypass defeats user authentication controls |
| IA-9 — Service Identification and Authentication | Appliance-to-appliance and backend trust can be abused after spoofing | |
| SI-4 — System Monitoring | Monitoring is needed to detect exploitation and post-compromise activity | |
| Recommendation — Strengthen and verify user authentication at the remote access boundary. Authenticate non-user connections and trusted service interactions explicitly. Monitor the appliance for anomalous access, commands, and configuration changes. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Logs are central to spotting bypass attempts and attacker activity |
| Recommendation — Centralize and review appliance logs for suspicious authentication and admin events. | ||
| NIST SP 800-57 | SC-12 — Cryptographic Key Establishment and Management | Compromise can expose keys that should be rotated after exploitation |
| Recommendation — Rotate exposed keys and secrets after confirming appliance compromise. | ||
Practitioner Guidance
Why practitioners should care: Remote access appliances are often treated as hardened edge infrastructure, but exploited auth-bypass bugs turn that assumption upside down. Prioritise them as exposure-critical assets, not routine infrastructure.
What to watch for: Any sign of unusual logins, admin actions, session anomalies, or unexpected configuration changes should be treated as potential post-exploitation evidence. If the appliance was reachable from the internet during the exposure window, review adjacent identity material as part of the response.
Practitioner takeaway: For edge appliances, the question is not only whether the patch is installed, but whether the device must now be treated as potentially compromised and revalidated end to end.
Related resources from NHI Mgmt Group
- CVE-2023-46805 (Ivanti Connect Secure and Policy Secure Authentication Bypass)
- CVE-2026-1603 (Ivanti Endpoint Manager (EPM) Authentication Bypass)
- What are the signs that an Ivanti Connect Secure appliance may have been compromised by CVE-2025-22457?
- CVE-2025-4427 (Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass)