CVE-2026-104935: Ivanti Connect Secure Auth Bypass Under Active Exploitation — Detection and Remediation Guide

On October 13, 2026, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) Catalog after Ivanti disclosed a critical authentication bypass vulnerability in Ivanti Connect Secure — and confirmed that threat actors are already exploiting it in the wild. This is not a theoretical risk. CISA has direct awareness of adversaries leveraging this flaw for credential theft and unauthorized data transfer against unpatched appliances.

If your organization runs Ivanti Connect Secure as a VPN gateway, you are holding one of the most targeted pieces of edge infrastructure in the threat landscape. These appliances sit at the perimeter, terminate authenticated sessions, and store credentials — which is exactly why adversaries keep coming back to them. A remote, unauthenticated attacker who can execute arbitrary commands on your VPN concentrator owns your front door.

The urgency here cannot be overstated: patch immediately, then hunt for compromise that may have already occurred. Patching a compromised appliance does not evict the adversary.

Affected Products and Versions

Per Ivanti's disclosure and the CISA alert, the following Ivanti Connect Secure versions are vulnerable:

• 25.1.1.1 and prior
• 25.1.2.2 and prior
• 22.8R2.4 and prior

CVE-2026-104935 is an authentication bypass vulnerability that enables remote, unauthenticated execution of arbitrary commands. In practical terms, an attacker with network reachability to the appliance's web interface — which, by design, is internet-facing — can bypass authentication controls and run commands with the privileges of the underlying system. No credentials, no phishing, no insider access required.

Exploitation Status

• Active exploitation: CONFIRMED. CISA states it is aware of cyber threat actors exploiting this unpatched vulnerability.
• Observed post-exploitation activity: credential theft and unauthorized data transfer (exfiltration).
• CISA KEV: Added October 13, 2026. Federal civilian executive branch agencies are bound by BOD 22-01 remediation timelines; all other organizations should treat KEV listing as a de facto mandate.

Attack Chain: Defender's Perspective

While Ivanti's advisory should be consulted for full technical detail, the exploitation pattern for this class of Connect Secure vulnerability follows a well-understood shape that defenders can hunt against:

1. Initial access: Attacker sends crafted requests to the internet-facing web interface of the Connect Secure appliance, bypassing authentication checks on a vulnerable component.
2. Command execution: The bypass yields arbitrary command execution on the appliance's underlying Linux-based operating system. Historically, exploitation of Ivanti web components surfaces as the web server process (or CGI/Python handlers under it) spawning unexpected child processes such as /bin/sh, bash, curl, wget, or Python/Perl one-liners.
3. Credential theft: Attackers harvest cached credentials, session tokens, and configuration data from the appliance — the exact post-exploitation behavior CISA has confirmed.
4. Exfiltration: Stolen data is staged and transferred off the appliance, typically via outbound HTTPS to attacker infrastructure, or tunneled through the appliance itself.
5. Persistence (likely): Edge-appliance intrusions almost always include webshells, modified legitimate scripts, or implanted binaries to survive reboots and even some patching events. Assume persistence until proven otherwise.

Because Connect Secure appliances are closed, vendor-managed systems, traditional EDR coverage is absent. Your visibility comes from syslog forwarding, network telemetry, and integrity checking — build your detection strategy accordingly.

Detection & Response

Sigma Rules

The following rules target behaviors observable where Connect Secure logs are ingested (Sysmon on adjacent Windows systems that interact with the appliance, and process/network telemetry from hosts in the VPN segment). The first rule is most valuable if you forward appliance syslog through a Linux collector with process auditing (auditd/Sysmon for Linux) or monitor jump hosts used to administer the appliance.

---
title: Ivanti Connect Secure Web Process Spawning Shell or Command Interpreter
id: 3f8a1c92-6d4e-4b7a-9c21-8e5f2a1d4b67
status: experimental
description: Detects web server or CGI processes associated with VPN gateway appliances spawning shells, downloaders, or scripting interpreters — consistent with post-exploitation of CVE-2026-104935 (unauthenticated RCE) on Ivanti Connect Secure.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/httpd'
      - '/nginx'
      - '/apache'
      - '/webserver'
      - '/cgi-bin'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor maintenance scripts executed during legitimate upgrades
  - Ivanti Integrity Checker Tool (ICT) runs — correlate with scheduled maintenance windows
level: high
---
title: Outbound Data Transfer from VPN Appliance to Rare External Destination
id: 9b2e7d41-3f6a-4c58-a1d9-5c8b3e7f2a94
status: experimental
description: Detects large or anomalous outbound connections sourced from VPN/edge appliance IP addresses to external destinations. CISA confirms CVE-2026-104935 exploitation involves unauthorized data transfer. Appliances should rarely initiate outbound connections beyond vendor update/telemetry endpoints.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/10/13
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: firewall
  product: zeek
detection:
  selection:
    src_ip|cidr:
      - '10.0.0.0/8'
    dst_port:
      - 443
      - 8443
      - 8080
    bytes_out|gt: 1000000
  filter_vendor:
    dst_host|contains:
      - 'ivanti.com'
      - 'pulsesecure.net'
  condition: selection and not filter_vendor
falsepositives:
  - Legitimate firmware update downloads — restrict src_ip to the actual appliance IPs and baseline vendor update FQDNs before deployment
level: medium

KQL — Microsoft Sentinel / Defender

This hunt assumes Connect Secure syslog is forwarded to Sentinel (CEF/Syslog ingestion) — a configuration you should have in place for any edge appliance. It looks for authentication anomalies and command-execution artifacts in appliance logs, plus Defender telemetry for follow-on credential access against hosts reached via the VPN.

// Hunt 1: Anomalous requests and command-execution artifacts in Ivanti Connect Secure syslog
// Ingest appliance logs via CEF/Syslog connector before running.
let lookback = 14d;
let ivanti_hosts = dynamic(["ics-vpn", "connect-secure"]); // replace with your appliance hostnames/IPs
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated >= ago(lookback)
    | where DeviceVendor has_any ("Ivanti", "Pulse Secure")
    | extend Payload = coalesce(Message, AdditionalExtensions)
    | where Payload has_any ("cmd=", "/bin/sh", "bash -c", "curl ", "wget ", "chmod +x", "base64 -d")
       or RequestURL has_any ("cgi-bin", ".cgi", "%2e%2e", "..;/")
    | project TimeGenerated, SourceIP, DestinationHostName, RequestURL, Payload, DeviceAction),
    (Syslog
    | where TimeGenerated >= ago(lookback)
    | where HostName has_any (ivanti_hosts) or Computer has_any (ivanti_hosts)
    | where SyslogMessage has_any ("unauthenticated", "auth bypass", "session hijack", "/bin/sh", "wget", "curl", "chmod")
    | project TimeGenerated, HostName, ProcessName, SyslogMessage)
| sort by TimeGenerated desc;

// Hunt 2: Follow-on credential theft on endpoints authenticated through the VPN
// Run against Defender XDR where VPN users land.
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where FileName in~ ("rundll32.exe", "comsvcs.dll", "reg.exe", "ntdsutil.exe", "vssadmin.exe")
   or ProcessCommandLine has_any ("lsass", "MiniDump", "sam save", "system save")
| where InitiatingProcessAccountName !in~ ("system", "local service")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated desc;

Velociraptor VQL

Use this on Windows jump hosts or admin workstations that manage the Connect Secure appliance — adversaries who steal appliance credentials frequently pivot to administrative endpoints and reuse harvested sessions from there.

-- Hunt for credential-theft tooling and anomalous processes on systems
-- used to administer the Ivanti Connect Secure appliance
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(lsass|minidump|comsvcs|secretsdump|mimikatz|sam\.save|ntdsutil)'
   OR Exe =~ '(?i)(psexec|wmiexec|crackmapexec|netexec)'
   OR (Name =~ '(?i)(cmd|powershell|wscript|cscript)' AND Ppid NOT IN (
        SELECT Ppid FROM pslist() WHERE Name =~ '(?i)(explorer|sccm|tanium)'))
ORDER BY CreateTime DESC

Verification and Triage Script

Run this against your appliance management interface (via an admin jump host with API/SSH access) and your log pipeline to validate patch level and pull the artifacts IR needs. Adjust paths and hostnames to your environment.

#!/bin/bash
# CVE-2026-104935 — Ivanti Connect Secure verification & triage helper
# Run from an admin workstation with SSH access to the appliance.

APPLIANCE="ics-vpn.example.com"   # replace with appliance FQDN/IP
ADMIN_USER="admin"
EVIDENCE_DIR="./ivanti_ir_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$EVIDENCE_DIR"

echo "[1] Collecting running version (confirm against patched release in Ivanti advisory)"
ssh "${ADMIN_USER}@${APPLIANCE}" 'cat /etc/version; uname -a' | tee "$EVIDENCE_DIR/version.txt"

echo "[2] Checking for unexpected child processes of the web server"
ssh "${ADMIN_USER}@${APPLIANCE}" "ps auxf | grep -E 'httpd|webserver' -A5 | grep -E 'sh$|bash|python|perl|curl|wget|nc '" | tee "$EVIDENCE_DIR/suspicious_procs.txt"

echo "[3] Reviewing recent admin and authentication logs for anomalies"
ssh "${ADMIN_USER}@${APPLIANCE}" 'ls -lt /home/logs/ | head -20; grep -iE "unauth|bypass|failed|error" /home/logs/log.events.v2 2>/dev/null | tail -100' | tee "$EVIDENCE_DIR/auth_anomalies.txt"

echo "[4] Checking crontab and startup scripts for persistence"
ssh "${ADMIN_USER}@${APPLIANCE}" 'crontab -l 2>/dev/null; ls -la /etc/init.d/ /home/etc/ 2>/dev/null' | tee "$EVIDENCE_DIR/persistence_check.txt"

echo "[5] Recent outbound connections from the appliance"
ssh "${ADMIN_USER}@${APPLIANCE}" 'netstat -anp 2>/dev/null | grep ESTABLISHED | grep -v 127.0.0.1' | tee "$EVIDENCE_DIR/connections.txt"

echo "[6] IMPORTANT: Run Ivanti's Integrity Checker Tool (ICT) per the vendor advisory."
echo "    A clean ICT result is required before trusting a patched appliance."
echo "Evidence collected in $EVIDENCE_DIR — preserve before patching if compromise is suspected."

Remediation

1. Patch immediately. Upgrade all Ivanti Connect Secure appliances to the latest fixed version as specified in Ivanti's Security Advisory for CVE-2026-104935. Affected trains are 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior — move to the fixed release for your train without delay. Reference: CISA Alert, October 13, 2026 and the linked Ivanti advisory.
2. Assume breach before patching. With confirmed in-the-wild exploitation involving credential theft, run Ivanti's Integrity Checker Tool (ICT) on every appliance. If ICT flags integrity violations, do not simply patch — isolate the appliance, preserve forensic evidence, and rebuild from a known-good image.
3. Rotate all credentials. Because confirmed exploitation includes credential theft: reset all local appliance admin accounts, all user credentials that authenticated through the VPN during the exposure window, service accounts, and any certificates or keys stored on the appliance. Invalidate active sessions.
4. Hunt the exposure window. Review appliance logs, VPN authentication logs, and network egress telemetry back at least 30 days (or to your last known-clean ICT result) for the indicators in the queries above. Pay particular attention to outbound transfers from the appliance itself.
5. Reduce attack surface. Restrict management interface access to a dedicated admin network/jump host. Confirm the appliance's web interface exposure matches policy — no management ports reachable from the internet.
6. Meet the KEV deadline. Federal agencies: comply with the BOD 22-01 due date listed in the KEV entry. Private sector: treat the KEV listing as your deadline benchmark — exploit code and scanning for Ivanti edge bugs proliferate within days of disclosure.
7. Verify syslog forwarding. If your Connect Secure appliance is not streaming logs to your SIEM today, fix that this week. You cannot hunt what you cannot see.

The Bottom Line

CVE-2026-104935 follows the most dangerous pattern in edge-device security: an internet-facing VPN concentrator, an unauthenticated remote code execution path, confirmed active exploitation, and credential theft as the attacker's objective. The remediation is straightforward — patch, run ICT, rotate credentials, hunt — but the sequence matters. Patch first to close the door, then treat every credential and session that touched the appliance during the exposure window as compromised. Organizations that only patch will remain breached.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub