Is CVE-2026-104935 (Ivanti Connect Secure Authentication Bypass by Spoofing) being exploited in the wild?

Yes. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue on 13 October 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.

What the KEV listing means for this Ivanti issue

CISA’s KEV catalogue is the practical signal that matters here: if a vulnerability is listed, defenders should treat it as actively exploited until proven otherwise. For Ivanti Connect Secure, that means the question is no longer abstract exposure, but whether your appliance is internet-facing, inventory is current, and the vendor’s remediation path has been applied on every instance.

A good first check is whether you have any Ivanti Connect Secure deployments that sit outside normal patch governance, such as branch appliances, disaster-recovery nodes, or rarely accessed admin interfaces. CISA Known Exploited Vulnerabilities Catalog should be used alongside the vendor advisory, not as a substitute for version-specific remediation details.

Why authentication bypasses on VPN edge devices are high-impact

An authentication bypass by spoofing on a remote access appliance can turn a perimeter control into an entry point for unauthenticated command execution. That is especially serious for VPN gear because it often sits at the boundary between the public internet and internal networks, which makes any compromise a potential pivot into broader infrastructure.

In practice, the danger is not just initial access. When the appliance also brokers remote sessions, stores configuration data, or handles administrative functions, an attacker may be able to use that foothold to reach credentials, sessions, or internal management interfaces. VPN Security Guide is a useful companion for understanding why edge-device compromise tends to have outsized blast radius.

What to validate if you are responsible for Ivanti Connect Secure

Start with exposure, not assumptions. Confirm every appliance version and deployment location, then verify whether the affected surface is actually reachable from the internet or from untrusted networks. If the device is part of a broader remote access stack, check adjacent controls such as MFA enforcement, administrative segmentation, and whether the appliance is still serving as a long-lived trust anchor for users and partners.

If your environment has a history of standing exceptions for VPN appliances, treat this as a trigger to tighten the asset list and reconcile it against patch status. Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both reinforce the same operating principle: exploited flaws need faster triage, not just normal patch-cycle treatment.

Risk and Threat Considerations

Authentication bypass on a perimeter appliance creates immediate exposure because the attacker does not need stolen credentials to begin interaction. Once remote command execution is available, the appliance may become a staging point for internal reconnaissance, session abuse, or follow-on access to other systems that trust the device.

Failure mechanism: Spoofed requests defeat the login boundary, allowing an unauthenticated attacker to issue commands through a system that was meant to restrict administrative or operational access.

Impact: The result can be full appliance compromise, loss of trust in remote access sessions, and potential pivoting deeper into the environment from a network position that defenders often treat as privileged.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes rapid vuln handling central to this VPN flaw.
Recommendation — Prioritise and remediate KEV-listed appliances first, then verify exposure and exposure windows.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires prompt remediation of a known exploited vulnerability.
	AU-6 — Audit Review, Analysis, and Reporting	Edge-device exploitation demands review of appliance logs for compromise signs.
	IA-2 — Identification and Authentication (Organizational Users)	The flaw bypasses authentication on a remote access device serving users.
Recommendation — Accelerate fix deployment and track exception handling for the affected appliance. Review appliance logs for unexpected access, config changes, and post-exploitation activity. Reinforce administrative and user authentication around the appliance after remediation.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	The subject is an exploited technical vulnerability on a perimeter product.
Recommendation — Track, prioritise, and remediate the Ivanti flaw through formal vulnerability management.

Practitioner Guidance

What to verify: Confirm the appliance is covered by emergency vulnerability handling, not routine backlog processing. For any instance that cannot be patched immediately, verify whether it is exposed to the internet, whether access is restricted to known management paths, and whether logs are retained long enough to support compromise assessment.

Decision rule: If the appliance may have been reachable during the exploitation window, treat the event as a possible incident, not just a patching task. That means checking for unexpected admin activity, configuration changes, new accounts or sessions, and unusual outbound traffic before concluding the box is clean.

Practitioner takeaway: With KEV-listed VPN flaws, the right question is not only “is it patched?” but “did this edge device already become a foothold?”