Topic starter
11/11/2026 6:03 pm
TL;DR: Remote unauthenticated access to Ivanti Connect Secure can bypass authentication and hand arbitrary command execution to attackers, according to runZero. Appliance compromise shifts remote access from a control point into a takeover point, so inventory, patch speed and integrity validation become operational priorities.
Editorial analysis by NHI Mgmt Group, based on content published by runZero: “How to find Ivanti Connect Secure appliances on your network”.
By the numbers:
- CVE-2026-104935 has a CVSS score of 8.6.
- Evidence indicates that CVE-2026-104935 is actively exploited in the wild.
- Ivanti Connect Secure 25.1.1.1 and prior versions are affected.
Key questions
Q: Why does authentication bypass on a gateway lead to full device control?
A: Authentication bypass on a gateway can lead to full device control because the gateway often sits in front of privileged management interfaces and trusts requests after login checks are skipped.
Q: How should teams manage exposed remote access appliances?
A: Teams should treat exposed remote access appliances as high-risk assets, place them in continuous inventory, and verify ownership, patch level, configuration and administrative exposure immediately.
Q: What are the signs that a targeted VPN appliance exploit is being probed before compromise?
A: Strong warning signs include repeated HTTP requests to the Host Checker Launcher, especially when they come from VPS providers or Tor exit nodes and check appliance versions in sequence.
Practitioner guidance
- Prioritise internet-facing appliance patching Move affected Ivanti Connect Secure instances to the fixed release line immediately, starting with devices that broker external access or admin access.
- Inventory every exposed remote access appliance Use software inventory and network discovery to identify all Ivanti Connect Secure devices, then confirm version, exposure and ownership for each one.
- Run post-exploitation integrity and log review Check appliance integrity, review indicators of compromise, and correlate authentication events with command activity before deciding whether a rebuild is needed.
Bottom line: This vulnerability turns a remote access appliance into a takeover point, which means the trust boundary itself is under attack.
Glossary terms: Ivanti Connect Secure, Authentication bypass, Command Execution, Remote Access Appliance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Remote access gateways behave like identity infrastructure, not ordinary network appliances. Once authentication is bypassed on a VPN concentrator, the attacker is operating inside the trust fabric that brokers access for users, admins and third parties. That makes the compromise an identity control failure as much as a device vulnerability, because the appliance is where authentication, authorisation and session handling converge. Practitioners should treat gateway exposure as part of IAM and PAM governance, not just patch management.
A question worth separating out:
Q: What is the best way to decide between patching and rebuilding a compromised appliance?
A: The decision depends on whether the compromise affected only software state or may have reached firmware, secrets or persistence mechanisms. Patching is suitable when integrity is still trusted and the issue is limited to a known vulnerability. Rebuilding is the safer choice when root access, unknown changes, stolen credentials or tampered firmware are possible, because a rebuild restores the appliance from a known-good image.
👉 Read our full editorial: Ivanti Connect Secure auth bypass lets attackers run commands