Ivanti Connect Secure auth bypass lets attackers run commands

At a glance

What this is: NHI Mgmt Group's analysis, drawing on runZero's report: Ivanti Connect Secure authentication bypass lets remote attackers execute commands on appliances and has already been exploited in the wild.

Why it matters: This matters because remote access gateways sit on the path to privileged identities, so compromise can expose credentials, sessions and administrative control across the access fabric.

By the numbers:

• CVE-2026-104935 has a CVSS score of 8.6.
• Evidence indicates that CVE-2026-104935 is actively exploited in the wild.
• Ivanti Connect Secure 25.1.1.1 and prior versions are affected.
• Ivanti Connect Secure 22.8R2.4 and prior versions are affected.

Context

Ivanti Connect Secure is a remote access VPN appliance, which makes it both a connectivity layer and an identity enforcement point. When an authentication bypass lands on that kind of system, the trust boundary moves from user identity to device control, and that changes how incident response has to be run.

The governance problem is not just the flaw itself. It is the combination of exposed edge devices, delayed patching, and limited visibility into which appliances are still reachable from the internet. In environments with third-party and remote workforce access, this becomes a standing exposure problem rather than a one-off vulnerability event.

Key questions

Q: What are the signs that a targeted VPN appliance exploit is being probed before compromise?

A: Strong warning signs include repeated HTTP requests to the Host Checker Launcher, especially when they come from VPS providers or Tor exit nodes and check appliance versions in sequence. That pattern suggests automated probing for a vulnerable release. Suspicious version checks combined with unexpected appliance traffic should be treated as likely pre-exploitation reconnaissance, not routine noise.

Q: Why does authentication bypass on a gateway lead to full device control?

A: Authentication bypass on a gateway can lead to full device control because the gateway often sits in front of privileged management interfaces and trusts requests after login checks are skipped. An attacker who bypasses that control can change configuration, intercept traffic, create accounts or pivot into internal systems. The key control is to enforce access policy at the gateway and restrict management functions with strong authentication and segmentation.

Q: How should teams manage exposed remote access appliances?

A: Teams should treat exposed remote access appliances as high-risk assets, place them in continuous inventory, and verify ownership, patch level, configuration and administrative exposure immediately. If the device is internet-facing, limit access with IP allowlists or VPN, rotate any credentials or secrets tied to it, and inspect for unauthorised changes. Unmanaged appliances should be isolated or removed from service until they are trusted again.

Q: What is the best way to decide between patching and rebuilding a compromised appliance?

A: The decision depends on whether the compromise affected only software state or may have reached firmware, secrets or persistence mechanisms. Patching is suitable when integrity is still trusted and the issue is limited to a known vulnerability. Rebuilding is the safer choice when root access, unknown changes, stolen credentials or tampered firmware are possible, because a rebuild restores the appliance from a known-good image.

Technical breakdown

How authentication bypass on a VPN appliance becomes command execution

An authentication bypass means a request is accepted as if the caller had already passed identity checks, even though no valid session or credential was presented. On a remote access appliance, that matters because authentication sits directly in front of administrative functions, policy enforcement and traffic brokering. If the bypass can be chained to command execution, the attacker is no longer limited to session abuse. They can operate the appliance itself, pivot into adjacent trust paths, or tamper with controls that protect remote users. See the Remote Access Identity Guide.

Practical implication: Treat any bypass on a remote access gateway as potential device takeover, not just access failure.

Why exposed edge appliances need separate inventory and triage

Edge appliances are often managed outside the normal asset pipeline, which means they can miss standard vulnerability scanning, endpoint telemetry and patch cadence reporting. That creates a visibility gap: the security team may not know which devices are internet-facing, which version they run, or whether they are still serving authentication traffic. When a vulnerability is being exploited in the wild, that gap becomes the real risk multiplier because defenders cannot prioritise what they cannot reliably enumerate. See the Vulnerability Management Guide.

Practical implication: Maintain a live inventory of externally reachable access appliances and tie it to version and exposure status.

What integrity checking can and cannot prove after exploitation

Integrity checking tools are useful for detecting post-compromise changes, but they do not replace patching or prove that an appliance was never touched. A clean result only means the current state matches expected baselines at the time of the check. For a device that handles authentication, that is not enough on its own, because an attacker may have executed commands, accessed sessions, or harvested material before the check ran. The operational question is whether the appliance should be rebuilt or only monitored after triage. See the Ivanti Connect Secure Hardening and Integrity Checking Guide.

Practical implication: Use integrity validation as one signal, then decide whether rebuild and credential reset are required.

Threat narrative

Attacker objective: The attacker aims to take over the remote access appliance and use that control to compromise the secure connectivity layer.

1. Entry occurs through an authentication bypass by spoofing on Ivanti Connect Secure, allowing a remote unauthenticated request to be treated as trusted.
2. Credential access is not required at the front door because the bypass removes the need for valid credentials before command execution.
3. Impact follows when the attacker runs arbitrary commands on the appliance and gains control over the secure remote access environment.

Breaches seen in the wild

• Ivanti Connect Secure exploitation 2024: Two Ivanti VPN zero-days exposed user passwords, service account credentials, API keys and certificates on 1,700+ appliances, including at CISA.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Remote access gateways behave like identity infrastructure, not ordinary network appliances. Once authentication is bypassed on a VPN concentrator, the attacker is operating inside the trust fabric that brokers access for users, admins and third parties. That makes the compromise an identity control failure as much as a device vulnerability, because the appliance is where authentication, authorisation and session handling converge. Practitioners should treat gateway exposure as part of IAM and PAM governance, not just patch management.

Active exploitation changes the decision model from remediation planning to exposure containment. When a flaw is already being used in the wild, the question is no longer whether to patch, but how fast to remove reachable exposure and verify appliance state. That is why internet-facing access infrastructure needs faster triage than ordinary asset classes, especially where remote administration is possible. The practical conclusion is that exploited edge devices belong in emergency response queues, not routine maintenance windows.

Authentication bypass on a remote access device creates a privileged-path collapse. The control gap is not only missing patch cadence. It is the assumption that the gateway remains trustworthy if the credentials in the environment are still intact. Here, the appliance itself becomes the target, so governance has to cover version state, reachability, logging and rebuild triggers together. Teams should classify remote access appliances as high-risk control points and manage them accordingly.

Integrity checks are necessary but not sufficient for compromised access appliances. A post-exploitation check can tell you whether the device still matches a known baseline, but it cannot unwind command execution, session theft or configuration tampering that happened before the scan. That means the named concept here is remote access appliance trust collapse: when the control layer that authenticates users becomes the thing that must be trusted least. Practitioners should plan for rebuild and credential reset decisions, not just verification.

What this signals

Remote access appliance trust collapse: once an attacker can bypass authentication on the gateway, the control point that should enforce trust becomes the place where trust fails. That is why exposure management for VPN and secure access appliances has to sit alongside privileged access governance, not outside it.

The practical signal for programmes is to shift these devices into a faster lifecycle than other network assets. Inventory accuracy, patch latency and rebuild criteria matter more when a single appliance can mediate authentication for an entire remote workforce or partner population.

For practitioners

• Prioritise internet-facing appliance patching Move affected Ivanti Connect Secure instances to the fixed release line immediately, starting with devices that broker external access or admin access.
• Inventory every exposed remote access appliance Use software inventory and network discovery to identify all Ivanti Connect Secure devices, then confirm version, exposure and ownership for each one.
• Run post-exploitation integrity and log review Check appliance integrity, review indicators of compromise, and correlate authentication events with command activity before deciding whether a rebuild is needed.
• Tighten emergency response for edge devices Place exploited VPN and gateway appliances into an emergency triage path with explicit escalation, containment and recovery owners.

Key takeaways

• This vulnerability turns a remote access appliance into a takeover point, which means the trust boundary itself is under attack.
• The issue is already being exploited in the wild, so patch speed and exposed-device inventory are operational priorities, not optional hygiene.
• Integrity checks help confirm state, but they do not by themselves prove that a gateway has not been used to execute attacker commands.

Related NHI Mgmt Group resources: Remote Access Identity Guide · Vulnerability Management Guide · Zero-Day and Exploited Vulnerabilities Guide · Ivanti Connect Secure Hardening and Integrity Checking Guide

Key terms

• Ivanti Connect Secure: A remote access and VPN appliance used to broker secure connectivity for users, administrators and partners. In security analysis, it matters because compromise of the device can expose the authentication layer itself, not just the traffic that flows through it.
• Authentication bypass: An authentication bypass is a flaw that lets a requester reach protected functionality without completing the intended identity check. In practice, it turns the application’s login boundary into a broken assumption, so any exposure path in front of that application becomes materially more important.
• Command Execution: Command execution is the ability to run arbitrary instructions inside a target environment. In cloud and DevOps settings, this can be legitimate for automation, but it becomes high risk when granted too broadly because it can modify systems, expose credentials, or support unauthorized data access.
• Remote Access Appliance: A remote access appliance is infrastructure that brokers external user or administrator connections into internal systems. Because it sits near authentication, network entry, and session control, a flaw in this layer can expose high-value access paths and create a broad compromise surface across the environment.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity controls to the wider security programme that depends on them.