Ivanti — Authentication Bypass and Remote Command Execution Zero-Day in Connect Secure (CVE-2026-104935)

Publication date: October 13, 2026
Category: Zero Days / Threat Intelligence

Introduction

Ivanti has issued a critical security advisory urging customers to immediately patch an actively exploited zero-day vulnerability affecting the Ivanti Connect Secure (ICS) remote access gateway. Tracked as CVE-2026-104935, this high-severity flaw allows unauthenticated remote attackers to execute arbitrary commands. The activity was brought to light by cybersecurity firm Volexity, which discovered that a previously unknown threat actor tracked as UTA0576 has been chaining this vulnerability since early October 2026 alongside other flaws to achieve root-level code execution on fully patched appliances without requiring valid credentials.

What is Ivanti Connect Secure and the Vulnerability? (General Analysis)

Ivanti Connect Secure (formerly known as Pulse Connect Secure and Juniper Pulse) is an enterprise-grade SSL VPN gateway engineered to provide remote workers, contractors, and hybrid organizations with secure access to corporate infrastructure and cloud assets. Positioned directly at the network perimeter, any security compromise within this component grants threat actors an optimal foothold into enterprise internal networks.

The vulnerability CVE-2026-104935 is formally categorized as an authentication bypass flaw via spoofing.

  • Official NVD Data:
    • CVE: CVE-2026-104935
    • CVSS v3.1 Score: 8.6 (HIGH)
    • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L (Verified by NVD)
    • CWE Classification: CWE-290 (Authentication Bypass by Spoofing)
    • CISA KEV Catalog: Yes (Listed in the Known Exploited Vulnerabilities catalog)

How Does It Work? (Technical Analysis)

The exploitation mechanism uncovered by threat intelligence researchers highlights advanced operational tactics employed by the UTA0576 threat cluster:

  • Initial Access Vector: Unprivileged remote attackers with no user interaction can trigger CVE-2026-104935 in low-complexity operations against vulnerable ICS appliances, bypassing standard authorization checks to run arbitrary commands.
  • Evasion and Persistence Techniques (Fileless & Log Tampering): Unlike traditional intrusion campaigns that deploy persistent web shells or malicious binaries onto the underlying file system, UTA0576 adopted a stealthier approach. The actor re-exploited the appliance for every command executed and deliberately tampered with system logs to erase forensic artifacts, effectively evading Ivanti’s built-in Integrity Checker Tool.
  • Exploit Chaining: The threat group successfully paired the authentication bypass zero-day with privilege escalation flaws within the same appliance ecosystem to secure deep system control.

“Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.” — Volexity Threat Intelligence.

Affected Systems / Environments

The vulnerability impacts multiple versions of the Connect Secure gateway software. Furthermore, the platform’s historical record displays a recurring pattern of critical perimeter flaws exploited in the wild.

Affected Versions (CVE-2026-104935)

  • Ivanti Connect Secure versions 22.8R2.4 and earlier.
  • Ivanti Connect Secure versions 25.1.2.2 and earlier.
  • Ivanti Connect Secure versions 25.1.1.1 and earlier.
  • Note: ICS versions 22.7R2.14 or prior are not impacted.

Associated Key Vulnerability History in ICS / Policy Secure Gateways

CVE CWE Category Impact CVSS Vector (Summarized)
CVE-2026-104935 CWE-290 (Spoofing) Command Execution / Bypass 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVE-2023-46805 CWE-287 (Auth Bypass) Restricted Resource Access 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE-2024-21887 CWE-77 (Command Inj.) Command Execution (Admin) 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2024-21893 CWE-918 (SSRF) Unauthenticated Resource Access 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE-2025-0282 CWE-121, CWE-787 Remote Code Execution (Buffer Overflow) 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2025-22457 CWE-121, CWE-787 Remote Code Execution (Buffer Overflow) 9.0 AV:N/AC:H/PR:N/UI:N/S:H/C:H/I:H/A:H

Mitigation and Detection

Remediation

  1. Immediate Patching: Apply the official vendor security advisories and firmware updates without delay.
  2. Integrity Checking: Regularly execute the Integrity Checker Tool (ICT) provided by Ivanti to spot potential OS-level anomalies.
  3. Perimeter Hardening: Ensure administrative interfaces are strictly segregated and never exposed directly to the public internet.

Detection

  • Log Review: Inspect inbound web gateway logs for anomalies, specifically repetitive pattern anomalies attempting session validation bypass.
  • Live Forensics: Because actors like UTA0576 avoid persistent file artifacts and wipe logs, perform live memory analysis and perimeter traffic inspection (NetFlow/PCAP) to identify unusual SSL/TLS session behaviors and undocumented API calls.

Wrapping Up

The emergence of the zero-day CVE-2026-104935 in Ivanti Connect Secure highlights the relentless targeting of enterprise edge infrastructure by sophisticated threat actors. The ability of attackers to bypass traditional detection mechanisms via log scrubbing and fileless command execution proves that passive patching alone is insufficient. Security teams must enforce continuous telemetry monitoring, integrity validation, and proactive threat hunting across all perimeter VPN gateways.

References