# Ivanti Connect Secure Authentication Bypass by Spoofing Zero-Day (CVE-2026-104935) Exploited in the Wild

> Ivanti disclosed CVE-2026-104935, an authentication bypass by spoofing flaw in Ivanti Connect Secure (ICS) that lets a remote unauthenticated attacker execute arbitrary commands on the appliance. Ivanti is aware of limited exploitation in the wild at disclosure, and CISA added the flaw to the KEV catalog on 2026-10-13 with a 2026-10-16 remediation due date.

- **Published:** 2026-10-13T15:57:55Z
- **Last reviewed:** 2026-10-15T18:34:50.822Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3420
- **ID:** TL-2026-3420
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UTA0576
- **Detections:** 9 · **IOCs:** 49 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-104935

## Description

CVE-2026-104935 is an authentication bypass by spoofing vulnerability (CISA KEV name: 'Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability'; CWE-290 per secondary reporting) in Ivanti Connect Secure, the SSL VPN gateway deployed at network perimeters. According to Ivanti and CISA, a remote unauthenticated attacker can exploit it in low-complexity attacks, with no user interaction, to execute arbitrary commands on the targeted appliance. Ivanti's October 2026 security update states that it is aware of limited exploitation in the wild at the time of disclosure. Volexity is credited with reporting the flaw.

Affected versions per Ivanti advisory coverage: ICS 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Secondary reporting (SecurityOnline) lists fixed releases 22.8R2.5, 25.1.1.2, and 25.1.3.0/25.1.3.1, and states that 22.7R2.14 and earlier are not impacted; the Ivanti advisory page could not be rendered by the research tooling, so these fixed-version details should be confirmed against the vendor advisory. SecurityOnline also reports a CVSS base score of 8.6 (High); NVD had no record at research time and the vector string was not published in any retrieved source, so none is recorded here.

Exploitation status: CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-13 with a due date of 2026-10-16 and references BOD 26-04 and forensics triage requirements. No public proof-of-concept was identified. Shadowserver tracks over 5,500 internet-exposed ICS instances, although that count includes honeypots and potentially already-secured instances. No IOCs (IPs, domains, hashes), malware families, or threat-actor attribution were published in any retrieved source; no BeaconBeagle correlation was possible because no network indicators exist yet.

Vendor guidance: upgrade to a fixed version immediately, review the security advisory, run Ivanti's Integrity Checker Tool (ICT) regularly, and apply layered security (strong access controls, network monitoring, log review, appliance integrity validation). Because the appliance is an edge device and exploitation yields command execution, defenders should treat any unpatched, internet-facing ICS as potentially compromised and perform forensics triage in addition to patching.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1133 External Remote Services
- T1556 Modify Authentication Process
- T1556 Modify Authentication Process
- T1059.006 Python
- T1068 Exploitation for Privilege Escalation
- T1070.002 Clear Linux or Mac System Logs
- T1070.004 File Deletion
- T1036.003 Rename Legitimate Utilities
- T1564.001 Hidden Files and Directories
- T1040 Network Sniffing
- T1110.003 Password Spraying
- T1087.002 Domain Account
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1041 Exfiltration Over C2 Channel
- T1059.004 Unix Shell
- T1036.005 Match Legitimate Resource Name or Location
- T1558.003 Kerberoasting
- T1552.001 Credentials In Files
- T1016 System Network Configuration Discovery
- T1583.003 Virtual Private Server
- T1055.009 Process Injection: Proc Memory
- T1071.001 Application Layer Protocol: Web Protocols
- T1140 Deobfuscate/Decode Files or Information
- T1105 Ingress Tool Transfer
- T1027 Obfuscated Files or Information

## Sources

- [Ivanti warns of Connect Secure zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/)
- [Security Advisory Ivanti Connect Secure (CVE-2026-104935)](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- [Ivanti October 2026 Security Update](https://www.ivanti.com/blog/october-2026-security-update)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2026-104935](https://nvd.nist.gov/vuln/detail/CVE-2026-104935)
- [Ivanti Connect Secure Vulnerability CVE-2026-104935 Exploited in the Wild](https://securityonline.info/ivanti-connect-secure-cve-2026-104935-exploited/)
- [CVE-2026-104935 tracking page](https://cve-security.com/cve/cve-2026-104935)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3420