Ivanti Connect Secure Authentication Bypass (CVE‑2026‑104935) Enables Unauthenticated Remote Code Execution
What It Is — A zero‑day authentication bypass in Ivanti Connect Secure (and Pulse Connect Secure) allows an unauthenticated attacker to send a crafted X‑DSCGI‑PATH header and obtain root‑level command execution.
Exploitability — Actively exploited in the wild; listed in the CISA Known Exploited Vulnerabilities catalog with a three‑day patch window. CVSS is not published but the vendor rates it “high‑severity.”
Affected Products — Ivanti Connect Secure / Pulse Connect Secure appliances running versions < 25.1.3 (including legacy supported releases).
Why It Matters for Trust & Control Assurance
- Continuous verification of authentication controls is a core control objective; a bypass defeats any static policy and erodes audit confidence.
- Real‑time evidence of patch deployment and configuration drift detection is essential to demonstrate due‑diligence to auditors and regulators.
- Logging of anomalous HTTP headers (e.g.,
X‑DSCGI‑PATH) provides the forensic trail needed for incident response and compliance reporting.
Recommended Actions
- Deploy Ivanti’s July 2026 patch (or later) to all Connect Secure appliances immediately.
- Verify firmware versions across the environment and enforce a patch‑management cadence that captures back‑ported fixes.
- Enable detailed web‑application logging and alert on unexpected
X‑DSCGI‑PATHrequests. - Review remote‑access segmentation and enforce multi‑factor authentication for any privileged VPN access.
- Document the remediation steps in your control‑evidence repository to support audit readiness.
Source: DataBreachToday – Ivanti VPN Zero‑Day Exploited in Active Attacks