A critical vulnerability in Ivanti Connect Secure is already being exploited by attackers, allowing them to bypass authentication entirely through spoofing and run arbitrary commands on affected systems without ever needing a valid login. The flaw, tracked as CVE-2026-104935, has been rated at the highest severity tier and is prompting urgent patching guidance from both Ivanti and the U.S. Cybersecurity and Infrastructure Security Agency.
What the vulnerability actually does
Ivanti Connect Secure is a widely deployed remote access gateway, the kind of software organizations rely on to let employees securely reach internal networks from outside the office. That makes it an especially attractive target: a single flaw in this layer can expose everything behind it. CVE-2026-104935 stems from an authentication bypass achieved through spoofing, meaning an attacker can impersonate a legitimate, trusted entity to slip past the system's access controls. Once inside, the attacker does not need stolen credentials or multi-factor codes. They can proceed straight to remote code execution, giving them the ability to run commands as if they were an authorized administrator.
The combination of three distinct impacts - remote code execution, security restriction bypass, and spoofing - is what elevates this from a routine bug to a serious incident. Each capability compounds the others: spoofing opens the door, the restriction bypass removes internal safeguards, and code execution lets an intruder plant persistent access, exfiltrate data, or pivot deeper into a corporate network.
Why remote access gateways keep becoming targets
Edge devices like VPN gateways sit at the boundary between the open internet and an organization's internal systems, which is precisely why they draw sustained attention from threat actors. Unlike a typical workstation protected by multiple layers of internal defense, a gateway is designed to be reachable from outside. When a flaw in that gateway allows authentication to be bypassed, the device's entire purpose - acting as a secure checkpoint - is undermined. This is a pattern that has recurred across the remote access software category in recent years: a vulnerability discovered in one widely used product can expose thousands of organizations simultaneously, from government agencies to hospitals to private enterprises, because the software is deployed at such scale.
The fact that CISA has issued a public alert alongside the vendor advisory signals that exploitation is not theoretical. Active exploitation means attackers have already built working tools to abuse the flaw before most organizations have had a chance to patch, which is why the response window matters more than usual.
Who is affected and what to do
The vulnerability affects Ivanti Connect Secure versions up to and including 22.8R2.4, 25.1.1.1, and 25.1.2.2. Organizations running any of these builds should treat the issue as an immediate priority rather than part of a routine patch cycle.
- Confirm which version of Ivanti Connect Secure is currently deployed across all gateways, including backup or secondary instances.
- Apply the vendor-issued fix referenced in Ivanti's security advisory without delay.
- Review access logs for signs of unusual authentication activity predating the patch, since exploitation has reportedly already occurred in some environments.
- Consult CISA's alert for additional guidance on detection and mitigation steps relevant to federal and enterprise networks alike.
Patching alone will not undo any compromise that already took place before the fix was applied, so organizations that suspect prior exploitation should treat the device as potentially breached and investigate accordingly rather than assuming a patch resolves the risk retroactively. For an edge appliance that authenticates remote users into a trusted network, the margin for delay is narrow.