MDR
Solutions
Partners
About
Resources
Affected Environment
Ivanti Connect Secure before 25.1.3.0, including 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
Threat Overview
Zero-day authentication bypass by spoofing, CVE-2026-104935 (CVSS 8.6), lets remote unauthenticated attackers execute arbitrary commands.
Exposure Timeline
Disclosed 13 October 2026; patched in 25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5.
Attack Surface
Internet-facing VPN gateway reachable by remote unauthenticated attackers.
Technical Root Cause
Authentication bypass by spoofing weakness in Connect Secure, tracked as CVE-2026-104935.
Exploitation Pathway
Remote attacker spoofs authentication to bypass access controls and execute arbitrary commands, with no credentials required.
Operational Impact
Arbitrary command execution on the VPN gateway, putting remote access infrastructure and internal networks at risk.
Strategic Impact
Compromised VPN gateways give attackers a trusted foothold into enterprise networks; all entity types rated High.
Required Mitigation
Upgrade to 25.1.1.2, 25.1.3.0, 25.1.3.1, or 22.8R2.5 after testing, as applicable to your branch.
Incident Response Guidance
Review gateway and authentication logs for anomalous access, isolate suspect appliances, and rotate credentials if compromise is suspected.
References
Ivanti Security Advisory, Volexity.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)