Authentication Bypass in Ivanti Connect Secure (CVE‑2026‑104935) Enables Remote Command Execution
What It Is – Ivanti Connect Secure (formerly Pulse Secure) contains an authentication‑bypass by spoofing flaw (CVE‑2026‑104935). A remote, unauthenticated attacker can trick the gateway into accepting a forged login and then execute arbitrary operating‑system commands.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code has been observed in the wild. The CVSS vector rates it as a high‑severity remote code execution risk.
Affected Products – Ivanti Connect Secure (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Authentication integrity – The flaw directly violates the control objective of maintaining robust, verifiable authentication mechanisms, a prerequisite for audit‑ready access‑control evidence.
- Continuous monitoring – Exploitation can be detected only if authentication events are logged and correlated in real time; gaps here weaken the defensible audit trail that regulators and enterprise buyers demand.
- Vendor oversight – Organizations that rely on third‑party remote‑access solutions must demonstrate that they receive timely patches and can prove remediation, a core component of third‑party risk assurance.
Recommended Actions
- Deploy Ivanti’s security update for CVE‑2026‑104935 without delay.
- Verify that authentication logs capture both successful and failed login attempts; integrate these logs into a SIEM or continuous‑control monitoring platform.
- Conduct a post‑patch validation test to confirm the bypass is fully mitigated and document the evidence for audit purposes.
Source: CISA KEV – CVE‑2026‑104935