What happened
A critical vulnerability has been identified in Ivanti Connect Secure, designated as CVE-2026-104935. The weakness allows a remote, unauthenticated attacker to bypass authentication by spoofing, which can enable the execution of arbitrary commands on affected systems. The vulnerability is linked to an authentication bypass flaw, classified under CWE-290, and has been confirmed to be actively exploited in the wild. Exploitation of this flaw could lead to unauthorised access and control over the impacted systems, potentially exposing sensitive information or enabling further malicious activity. Organisations running Ivanti Connect Secure are advised to consider the potential severity of this flaw and the real-world risks associated with active exploitation.
Who is affected
Organisations operating Ivanti Connect Secure may be impacted by this vulnerability. Since the flaw involves an authentication bypass, any deployment accessible from the internet or exposed remotely could be vulnerable. The specific versions and configurations that are susceptible are not detailed; therefore, all affected deployments are urged to review their exposure and consider mitigation measures. Due to the active exploitation reported, any environment using this product that is internet-facing or otherwise accessible without strict controls could remain at risk until proper mitigations are applied.
Recommended actions
To mitigate this vulnerability, affected organisations must apply the mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance. This includes evaluating each asset’s internet exposure and prioritising rapid application of security controls based on the system’s risk profile. If mitigations are unavailable, discontinuing the use of the product may be necessary until updates are implemented. Cybersecurity teams should ensure adherence to CISA’s “Forensics Triage Requirements” and actively monitor for malicious activity indicative of exploit attempts, given the confirmed active exploitation.
