# CVE-2026-104935: Ivanti Connect Secure RCE via Auth Bypass

> CISA confirms active exploitation of CVE-2026-104935 in Ivanti Connect Secure, an auth bypass leading to remote code execution.

- Published: 2026-10-13T15:30:11.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Authentication Bypass, Remote Code Execution, CISA KEV, VPN, CVE-2026-104935
- CVEs: CVE-2026-104935
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104935
- Canonical: https://runtimerebel.com/blog/cve-2026-104935-ivanti-connect-secure-rce-via-auth-bypass

## Key points

- Remote unauthenticated attackers can execute arbitrary commands on Ivanti Connect Secure devices.
- All Ivanti Connect Secure VPN appliances are vulnerable to this authentication bypass.
- Apply vendor-supplied mitigations or discontinue product use by October 16, 2026.

## Overview: Critical Ivanti Connect Secure Authentication Bypass ([CVE](/glossary#cve)-2026-104935)

Cybersecurity professionals must immediately address a critical authentication bypass [vulnerability](/glossary#vulnerability), identified as [CVE-2026-104935](https://nvd.nist.gov/vuln/detail/CVE-2026-104935), affecting Ivanti Connect Secure appliances. The [Cybersecurity and Infrastructure Security Agency (CISA)](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) has added this vulnerability to its Known Exploited Vulnerabilities ([KEV](/glossary#kev)) Catalog, confirming active exploitation in the wild. This designation underscores the urgency for all organizations utilizing Ivanti Connect Secure to prioritize remediation.

According to [CISA's Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-104935), CVE-2026-104935 enables a remote, unauthenticated attacker to bypass authentication mechanisms and execute arbitrary commands on affected systems. The implications of such a flaw are severe, as Ivanti Connect Secure devices are commonly deployed as [VPN](/glossary#vpn) solutions, serving as critical gateways to internal networks. Successful exploitation could lead to full network compromise, [data exfiltration](/glossary#data-exfiltration), and significant operational disruption, highlighting why this threat matters profoundly to organizational security posture.

### Technical Analysis of Ivanti Connect Secure Authentication Bypass [Exploit](/glossary#exploit)

The vulnerability, categorized under [CWE](/glossary#cwe)-290 (Authentication Bypass by Primary Weakness or Design Error), specifically allows for an **Ivanti Connect Secure authentication bypass exploit** by means of [spoofing](/glossary#spoofing). This means an attacker can masquerade as a legitimate user or system, circumventing the normal authentication process without needing valid credentials. Once authentication is bypassed, the attacker gains the ability to execute arbitrary commands, granting them extensive control over the compromised appliance and potentially the internal network it protects. This level of access enables adversaries to establish [persistence](/glossary#persistence), deploy additional [malware](/glossary#malware), steal sensitive data, or launch further attacks within the network.

The widespread use of Ivanti Connect Secure products across various sectors makes this vulnerability a high-priority concern. Organizations relying on these appliances for secure remote access are directly affected, facing the risk of sophisticated attacks that leverage this critical flaw. The confirmation of active exploitation by CISA elevates CVE-2026-104935 from a theoretical risk to an immediate and demonstrable threat that security teams must contend with.

### Actionable Recommendations: CVE-2026-104935 Mitigation Steps

Defenders must prioritise immediate action to mitigate the risks posed by CVE-2026-104935. CISA's guidance is clear and prescriptive:

*   **Apply Vendor Mitigations:** The primary recommendation is to apply all available mitigations and security updates provided by Ivanti. Organizations should consult vendor advisories and apply patches or workarounds as soon as they become available.
*   **Adhere to CISA BOD 26-04:** Compliance with CISA’s Binding Operational Directive (BOD) 26-04, which mandates prioritizing security updates based on risk, is crucial. This includes evaluating each asset's internet exposure and ensuring adherence to patching guidelines.
*   **Forensics Triage:** In light of confirmed active exploitation, organizations should be prepared to perform forensics triage on potentially affected systems to identify any signs of compromise.
*   **Discontinue Use if Unmitigable:** If vendor-supplied mitigations are unavailable or cannot be effectively implemented, organizations should consider discontinuing the use of the affected Ivanti Connect Secure product.
*   **Federal Remediation Due Date:** Federal agencies are mandated to remediate this vulnerability by October 16, 2026. Non-federal entities should treat this deadline as a critical benchmark for their own remediation efforts.

Implementing these **CVE-2026-104935 mitigation steps** is paramount to protecting network infrastructure from ongoing exploitation. Given the nature of this remote code execution vulnerability and its active exploitation, continuous monitoring for unusual activity on Ivanti Connect Secure devices and associated network segments is also strongly advised.

**Related:** [CVE-2026-60004: Gitea Code Injection Under Active Exploitation](/blog/cve-2026-60004-gitea-code-injection-under-active-exploitation), [CVE-2026-59822: BerriAI LiteLLM Authentication Bypass](/blog/cve-2026-59822-berriai-litellm-authentication-bypass)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-104935-ivanti-connect-secure-rce-via-auth-bypass