Zero‑Day Authentication Bypass in Ivanti Connect Secure (CVE‑2026‑104935) Enables Remote Command Execution
What It Is — Ivanti disclosed CVE‑2026‑104935, an authentication‑bypass flaw in Connect Secure that permits unauthenticated remote execution of arbitrary commands. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
Exploitability — Threat actors are already leveraging the flaw in the wild; no public proof‑of‑concept is required. The vulnerability scores a CVSS ≥ 9.8 (critical) due to remote code execution and potential credential theft.
Affected Products — Ivanti Connect Secure appliances version 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier (both hardware and virtual deployments).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of authentication controls is essential; a bypass defeats any static policy and erodes audit confidence.
- Rapid patch management provides verifiable evidence that the organization maintains a defensible change‑management process.
- Forensic readiness (memory and network logs) supplies the documentation needed for incident investigations and regulator‑required reporting.
Recommended Actions
- Deploy the latest Ivanti Connect Secure patch across all appliances.
- Conduct memory and network forensics to detect any prior exploitation.
- Reset all local, domain, and administrator passwords; rotate certificates, API keys, and stored credentials.
- Document the remediation steps in your control‑evidence repository for audit readiness.
Source: CISA Advisory – Oct 13 2026