Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)

1. Apply Security Patches

Update to the latest firmware version provided by the vendor:

• Ivanti Connect Secure 25.1.3.0 or higher.

2. Temporary Mitigations

If immediate patching is not possible, implement the following:

• Restrict access to the Management Interface (Admin UI) from the public internet using strict firewall rules.
• Enforce Multi-Factor Authentication (MFA) for all user roles.
• Monitor VPN logs for anomalous session creation or unauthorized access attempts to sensitive API endpoints.

3. Compromise Assessment

Run the Ivanti Integrity Checker Tool (ICT) to verify the integrity of the system files and detect potential web shells or unauthorized modifications.

CVE-2026-104935 is a critical authentication bypass vulnerability (CWE-290) in Ivanti Connect Secure. It allows an attacker to spoof trusted identifiers to circumvent the authentication mechanism. Once bypassed, the attacker can achieve Remote Code Execution (RCE), effectively gaining full control over the VPN gateway. The vulnerability's inclusion in the CISA KEV catalog and its high EPSS score (0.94) indicate that it is actively being exploited in the wild by threat actors to facilitate initial access and lateral movement within corporate networks.