CVE-2026-104935: Ivanti Connect Secure Authentication Bypass Leading to RCE

Overview

CVE-2026-104935 is an authentication bypass by spoofing vulnerability affecting Ivanti Connect Secure appliances. This flaw enables a remote, unauthenticated attacker to execute arbitrary commands on the vulnerable system. Given the potential for complete system compromise without prior authentication, this vulnerability presents a high risk to affected organizations.

Technical Analysis

The vulnerability, identified as CWE-290 (Authentication Bypass by Spoofing), resides in Ivanti Connect Secure (ICS). It allows an attacker to bypass authentication mechanisms through a spoofing technique, granting them unauthorized access. Upon successful exploitation, the attacker can execute arbitrary commands on the underlying operating system of the ICS appliance.

• Vulnerability Type: Authentication Bypass by Spoofing (CWE-290)
• Affected Products: Ivanti Connect Secure (ICS)
• Affected Versions: All versions before 25.1.3.0.
• Not Impacted Versions: ICS version 22.7R2.14 or prior are not impacted.
• Attack Vector: Network (AV:N)
• Authentication: None required (PR:N)
• Impact: High confidentiality, low integrity, low availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, CVSS 3.1 Base Score: 8.6 HIGH)
• Prerequisites: None, remote unauthenticated access is sufficient.

Detection

Detecting exploitation of this vulnerability primarily involves monitoring Ivanti Connect Secure appliance logs for post-exploitation activity.

• Appliance System Logs: Monitor for unusual process creations originating from the Ivanti service accounts or web server processes. Look for spawns of shell interpreters (sh, bash, cmd.exe, powershell.exe) or other unexpected binaries.
• Network Flow Logs: Monitor outbound network connections from the Ivanti Connect Secure appliance for unusual destinations, protocols, or high volumes of data transfer, which could indicate command and control (C2) activity or data exfiltration.
• Web Server Access Logs: While specific exploit patterns are not publicly detailed, monitor for highly unusual or malformed requests to authentication endpoints or administrative interfaces that deviate from normal user behavior.
• File System Monitoring: Look for unexpected file writes or modifications in critical system directories or web root directories on the appliance, which could indicate webshell deployment or configuration changes.

Sigma Detection Rules

Ivanti Connect Secure – Suspicious Child Process from Web Process

title: Ivanti Connect Secure - Suspicious Child Process from Web Process
id: 900c3b2e-f7a6-4e5c-9d1a-6f0e3b2c1d4f
status: experimental
description: Detects suspicious child processes (e.g., shells) spawned by Ivanti Connect Secure web server processes, indicative of successful RCE exploitation of CVE-2026-104935.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|contains:
      - 'httpd'
      - 'nginx'
      - 'ics-web' # Placeholder for a potential Ivanti specific web process
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
      - '/usr/bin/nc'
      - '/usr/bin/socat'
  condition: selection
level: high

Mitigations

1. Patch Immediately: Apply the security update to Ivanti Connect Secure version 25.1.3.0 or later as soon as possible. This is the primary and most effective mitigation.
2. Network Segmentation: Isolate Ivanti Connect Secure appliances on a dedicated network segment with strict egress filtering to limit potential lateral movement or C2 communication in case of compromise.
3. Monitor Appliance Logs: Implement robust logging and monitoring for the Ivanti Connect Secure appliance, forwarding logs to a SIEM for analysis and alerting on suspicious activities.
4. Regular Backups: Maintain regular, tested backups of the Ivanti Connect Secure configuration and system state to facilitate recovery in the event of a successful attack.

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935
• https://nvd.nist.gov/vuln/detail/CVE-2026-104935

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1059 — Command and Scripting Interpreter
• T1078.004 — Cloud Accounts