CVE-2026-104935: Ivanti Connect Secure Authentication Bypass Actively Exploited — Detection and Remediation Guide

On October 13, 2026, CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in IR have been dreading: Ivanti Connect Secure (ICS) is once again under active, confirmed exploitation in the wild. This is an authentication bypass by spoofing vulnerability that allows a remote, unauthenticated attacker to execute arbitrary commands on the appliance. Let that sink in — no credentials, no session, no prior access. Just a reachable ICS portal and a crafted request.

Ivanti Connect Secure sits at the perimeter by design. It terminates VPN sessions, brokers access to internal resources, and holds the keys to your network's front door. A compromise here is not a foothold — it is a full breach of the trust boundary. If you run ICS anywhere in your environment, this is a stop-everything event. Patch, hunt, and assume compromise until proven otherwise.

Technical Analysis

Vulnerability Overview

How the Attack Works (Defender's View)

Authentication bypass by spoofing (CWE-290) means the appliance's authentication logic can be tricked into treating an attacker-controlled request as if it originated from a trusted source — typically by spoofing a trusted identity, origin, or session artifact in the HTTP request. In practical terms, the exploitation chain on an ICS appliance looks like this:

1. Reconnaissance — The attacker scans internet-facing ICS portals. ICS instances are trivially fingerprintable by their login page and TLS characteristics, and public scan data (Shodan, Censys) makes target enumeration effortless.
2. Authentication Bypass — A crafted request to the portal spoofs a trusted origin or identity token, causing the appliance to skip authentication entirely and reach a privileged handler.
3. Command Execution — The bypassed endpoint processes attacker-controlled input as operating system commands on the underlying hardened Linux appliance, typically executing as the web service user with broad local privileges.
4. Post-Exploitation — Based on historical ICS tradecraft, expect webshell or backdoor implantation in writable directories (/tmp, /home/..., web-accessible paths), log tampering, credential harvesting from the appliance's configuration, and pivoting into the internal network over the VPN's own trust relationships.

Why This Is Especially Dangerous

• No authentication required. There is no credential stuffing, no phishing, no user interaction. Any internet-exposed ICS portal is a target.
• Perimeter position. ICS appliances see decrypted VPN traffic and hold authentication material for the entire remote-access user base.
• Limited native telemetry. ICS appliances do not support EDR agents. Your detection surface is syslog forwarding, network monitoring, and the appliance's own integrity tooling — all of which attackers specifically target for tampering.
• Historical pattern. Ivanti edge devices have repeatedly been used by sophisticated actors for stealthy, long-dwell intrusions. Treat every exposed appliance as potentially already compromised.

Detection & Response

This is a technical threat with confirmed active exploitation. Detection content below is written for real operational use — tuned to the observable behaviors of web-service exploitation on a Linux appliance, not speculative noise.

Priority telemetry sources: ICS syslog forwarded to your SIEM (authentication events, admin logins, log-clearing events), network egress from the appliance's management and tunnel interfaces, and downstream endpoint telemetry on hosts reachable via VPN.

Sigma Rules

---
title: Ivanti Connect Secure Web Process Spawning Shell
description: Detects the ICS web service or related appliance processes spawning interactive shells or command interpreters — a strong indicator of successful web exploitation such as CVE-2026-104935 on Linux-based appliances.
status: experimental
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/10/13
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/home/bin/httpd'
      - 'webserver'
      - '/home/bin/web'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate appliance maintenance scripts — validate against change windows
level: critical
---
title: Webshell-Style Command Chaining from VPN Appliance Syslog
description: Detects command execution patterns typical of webshell post-exploitation (curl/wget pipe to shell, base64 decode and execute, chmod then execute) observed in syslog forwarded from network appliances.
status: experimental
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/13
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - 'curl'
    - 'wget'
  selection_pipe:
    - '| sh'
    - '|sh'
    - '| bash'
    - '|bash'
  selection_b64:
    - 'base64 -d'
    - 'base64 --decode'
  selection_write:
    - '/tmp/'
    - 'chmod +x'
  condition: (selection and selection_pipe) or (selection_b64 and selection_write)
falsepositives:
  - Administrator maintenance on the appliance CLI — correlate with authenticated admin sessions
level: high
---
title: Unexpected Outbound Connection from VPN Appliance Process
description: Detects outbound network connections initiated by shell or scripting interpreters on a hardened VPN appliance, consistent with reverse shells or payload staging after exploitation of CVE-2026-104935.
status: experimental
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/10/13
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/perl'
      - '/nc'
      - '/ncat'
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate package/vendor update checks — Ivanti appliances should have a narrow, known egress allowlist; investigate anything outside it
level: high

KQL — Microsoft Sentinel / Defender

ICS appliances forward logs via syslog/CEF. If you ingest ICS logs into Sentinel (via a syslog collector or AMA), hunt for exploitation and post-exploitation artifacts in CommonSecurityLog and Syslog, and hunt for downstream impact in DeviceProcessEvents for hosts authenticated through the VPN.

// Hunt 1: Suspicious command execution and webshell patterns in ICS syslog (last 14 days)
let lookback = 14d;
union isfuzzy=true (CommonSecurityLog, Syslog)
| where TimeGenerated >= ago(lookback)
| where Computer has_any ("ivanti", "ics", "pulse", "vpn") // adjust to your ICS host naming
| extend RawMsg = coalesce(AdditionalExtensions, Message, "")
| where RawMsg has_any ("| sh", "|sh", "| bash", "|bash", "base64 -d", "chmod +x", "/tmp/", "curl http", "wget http", "python -c", "perl -e")
| project TimeGenerated, Computer, SourceIP=SourceIP, RawMsg
| order by TimeGenerated desc;

// Hunt 2: ICS admin logins from unexpected sources or log-clearing events
let lookback = 14d;
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where DeviceVendor has_any ("Ivanti", "Pulse Secure")
| where Message has_any ("admin login", "administrator logged in", "log cleared", "logs deleted", "archive deleted")
| project TimeGenerated, SourceIP, SourceUserName, Message, DeviceProduct, DeviceVersion
| order by TimeGenerated desc;

// Hunt 3: Downstream impact — hosts that received VPN sessions around suspected compromise,
// spawning unusual processes shortly after session establishment
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName has_any ("vpn", "pulse", "ivanti") or RemoteIP in (
    // substitute: IPs of your ICS tunnel interfaces
    dynamic([]))
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "rundll32.exe", "psexec.exe", "net.exe", "nltest.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, RemoteIP
| order by TimeGenerated desc;

Velociraptor VQL

Velociraptor cannot run on the ICS appliance itself, but it is invaluable for hunting downstream compromise — endpoints that received attacker sessions over the VPN, or jump hosts the attacker pivoted to. Hunt for execution artifacts consistent with hands-on-keyboard activity following VPN access.

-- Hunt for suspicious execution artifacts on VPN-accessible hosts
-- indicative of post-exploitation lateral movement from a compromised ICS appliance
LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(psexec|wmiexec|crackmapexec|net user|net group|nltest|whoami /all|vssadmin delete|wevtutil cl|curl .*(http|https).*\|)'
   OR Exe =~ '(?i)(\\users\\public\\|\\programdata\\[^\\]*\\[^\\]*\.exe|\\temp\\[^\\]*\.exe)'

LET suspicious_conns = SELECT Pid, Name, Path, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemotePort in (4444, 8443, 1337, 9001, 443)
  AND Name =~ '(?i)(cmd|powershell|wscript|rundll32)'

SELECT * FROM suspicious_procs
UNION ALL
SELECT * FROM suspicious_conns

Triage & Forensics Script

Per CISA's KEV required action and the referenced Forensics Triage Requirements, you must capture evidence before patching or factory-resetting the appliance. Run this on the ICS appliance CLI (or via a maintenance shell) to collect volatile evidence, verify integrity, and check for common post-exploitation artifacts.

#!/bin/bash
# CVE-2026-104935 — Ivanti Connect Secure triage & evidence collection
# Run as root on the ICS appliance. Copy output OFF the box immediately (scp/syslog).

OUT="/tmp/ics_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT"

echo "=== 1. System & version fingerprint ==="
cat /etc/*release 2>/dev/null > "$OUT/os_version.txt"
uname -a >> "$OUT/os_version.txt"
# ICS build number is also visible in Admin UI > System > Status — record it separately.

echo "=== 2. Running processes (look for shells/scripts parented by web/httpd) ==="
ps auxf > "$OUT/process_tree.txt"
grep -Ei 'httpd|webserver' "$OUT/process_tree.txt" | grep -Ei 'sh|bash|python|perl|curl|wget' > "$OUT/SUSPICIOUS_procs.txt"

echo "=== 3. Network connections (unexpected outbound from appliance) ==="
netstat -antup 2>/dev/null > "$OUT/netstat.txt"
established=$(awk '$6=="ESTABLISHED"' "$OUT/netstat.txt" | grep -Ev '127.0.0.1|::1')
echo "$established" > "$OUT/established_conns.txt"

echo "=== 4. Recently modified files in writable/web directories (last 14 days) ==="
find /tmp /var/tmp /home -type f -mtime -14 2>/dev/null > "$OUT/recent_files.txt"
find / -name '*.jsp' -o -name '*.cgi' -o -name '*.pl' 2>/dev/null | grep -Ev '/pkg/|/data/' > "$OUT/web_scripts.txt"

echo "=== 5. Cron & persistence mechanisms ==="
crontab -l > "$OUT/root_crontab.txt" 2>/dev/null
ls -la /etc/cron* > "$OUT/cron_dirs.txt" 2>/dev/null
cat /etc/rc.d/rc.local > "$OUT/rc_local.txt" 2>/dev/null

echo "=== 6. Log integrity — look for gaps or tampering ==="
ls -la /var/log* /home/var/log* 2>/dev/null > "$OUT/log_listing.txt"
# Check admin/event/user logs via Admin UI: System > Log/Monitoring
# Export ALL logs before any reboot or remediation.

echo "=== 7. Run Ivanti Integrity Checker Tool (ICT) ==="
echo "MANUAL STEP: Admin UI > System > File Integrity > run ICT scan."
echo "MANUAL STEP: If ICT reports NEW or MODIFIED files not attributable to a known Ivanti update, treat appliance as COMPROMISED."

echo "=== 8. Package evidence ==="
tar czf "${OUT}.tar.gz" -C /tmp "$(basename $OUT)" 2>/dev/null
echo "Evidence bundle: ${OUT}.tar.gz"
echo "CRITICAL: scp this bundle to a forensic workstation NOW, then snapshot logs off-box."
echo "Do NOT reboot, patch, or factory reset until evidence is preserved per CISA Forensics Triage Requirements."

Remediation

CISA's KEV entry carries a mandatory remediation deadline for federal agencies under BOD 26-04 (Prioritizing Security Updates Based on Risk) — treat that deadline as your own regardless of sector. CISA's required action is explicit: apply vendor mitigations, comply with BOD 26-04 and the Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable.

Execute in this order:

1. Assess Exposure Immediately

• Inventory every ICS instance, including lab, DR, and legacy Pulse Secure-branded appliances.
• Verify which portals are internet-reachable. Check external scan data (Shodan/Censys) for your IP ranges — if a scanner can see it, so can the threat actors already exploiting this CVE.
• If a portal is exposed and not business-critical this week, take it offline or ACL-restrict it to known source IPs now, before anything else.

2. Preserve Evidence First (Forensics Triage)

• Per CISA's Forensics Triage Requirements referenced in the KEV entry: export all logs (Admin UI: System > Log/Monitoring — admin, event, and user access logs) and run the evidence collection script above before patching or resetting.
• Retain a full system snapshot/config backup and any memory captures your appliance maintenance mode supports.

3. Run the Integrity Checker Tool (ICT)

• Execute Ivanti's external and internal ICT scans on every appliance.
• ICT findings of unexpected new/modified files = treat as compromised. Do not simply patch over a compromised appliance — factory reset and rebuild from known-good media, then apply the fix.

4. Apply the Vendor Fix

• Apply the remediation per Ivanti's official security advisory for CVE-2026-104935 (check Ivanti's Security Advisory portal and the CISA KEV entry for the advisory link and fixed build numbers).
• Do not trust version strings alone — Ivanti has previously shipped interim mitigations that did not fully close attack paths. Confirm the specific fixed build against the advisory.
• After patching, re-run ICT to establish a clean integrity baseline.

5. Assume Breach — Rotate Everything

If the appliance was internet-exposed and unpatched during the exploitation window:

• Rotate all credentials that transited or were stored on the appliance: local admin accounts, AD/LDAP bind accounts, RADIUS shared secrets, certificate private keys, and every VPN user's password.
• Revoke and reissue appliance TLS certificates.
• Hunt downstream (KQL Hunts 2 and 3 above) for lateral movement sourced from VPN tunnel IPs during the exposure window.
• Review admin logins against known-good source IPs and MFA enrollment records.

6. Harden Going Forward

• Forward ICS syslog to your SIEM in real time with off-box retention — log tampering is standard tradecraft against these appliances.
• Restrict management interfaces to a dedicated admin VLAN; never expose the admin UI to the internet.
• Implement strict egress filtering on the appliance's interfaces — an ICS box has almost no legitimate reason to initiate arbitrary outbound connections.
• Add ICS ICT scan scheduling and alerting on any integrity deviation.
• If you cannot meet the vendor's mitigation timeline: per CISA, discontinue use of the product. That is not hyperbole — an unmitigated, exploited edge device is worse than no VPN.

Bottom Line

CVE-2026-104935 is not a "patch when convenient" event — it is confirmed active exploitation of the device that guards your network's front door, with unauthenticated remote command execution. The sequence is non-negotiable: restrict exposure → preserve evidence → run ICT → remediate or rebuild → rotate credentials → hunt downstream. Every hour an unpatched ICS portal sits exposed is an hour the threat actors already using this bug can use it against you.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub