Hackers abuse the Ivanti Connect Secure bug to gain access without accounts
Attackers exploited Ivanti Connect Secure CVE-2026-104935 to bypass login and run commands; CISA added it to KEV.
Attackers without their own accounts logged into Ivanti Connect Secure appliances through an authentication-bypass flaw and then ran arbitrary commands. Ivanti tracks the issue as CVE-2026-104935 with a CVSS score of 8.6; it affects Connect Secure 22.8R2.4 and earlier plus specified 25.1 releases, while versions 22.7 and earlier are unaffected. Fixes include 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. Ivanti said exploitation occurred while backports were still underway, watchTowr described spoofing of identity signals, Volexity published exploitation details, and CISA added the flaw to its KEV catalog on October 13.
- CVE-2026-104935 is an unauthenticated authentication bypass rated CVSS 8.6.
- Attackers executed arbitrary commands on Connect Secure appliances.
- Fixes include 22.8R2.5 and specified 25.1 builds.
- CISA added the flaw to KEV on October 13.
- Volexity and watchTowr documented the exploited path.
Vulnerabilities mentionedAll →
- CVE-2026-1049358.626%Auth Bypass to Command Execution in Ivanti Connect Securepublished · Ivanti Connect Secure KEV PoC ×2
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-104935 |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 25.1.1.2 | Ivanti has released fixes, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and soft |
| ipv4 | 25.1.3.1 | s, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and software branch. Security te |
Full article249 words · extracted from csoonline.com · click to collapse
Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances.
“Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0,“ the vendor said in a security advisory. ”We had been working to backport the fix to the remaining supported versions when exploitation occurred.”
According to security firm watchTowr’s vulnerability FAQ, the flaw allowed remote attackers to spoof the signals used to establish a user’s identity, bypassing normal authentication checks. The bypass uses a path separate from normal authentication, so existing login protections do not stop it, watchTowr added.
Tracked as CVE-2026-104935 and rated at CVSS 8.6 out of 10, the vulnerability affects multiple product branches, including Ivanti Connect Secure 22.8R2.4 and earlier, as well as specified 25.1 releases. Ivanti says versions 22.7 and earlier are not affected.
Ivanti has released fixes, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and software branch. Security teams were advised to identify their deployed versions, apply corresponding fixes, and investigate potential compromise.
While Ivanti said reliable indicators of compromise were not yet available, Volexity, the cybersecurity firm credited with discovering the flaw, has published details of its exploitation. The US Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities (KEV) catalog on October 13.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.csoonline.com/article/4235129/hackers-abuse-the-ivanti-connect-secure-bug-to-gain-access-without-accounts.html