.jpg)
if ( !emtpy($headline_subheadline ) ) : ?>
The critical authentication bypass allowed remote attackers to bypass login checks and execute commands on vulnerable appliances before patches were fully backported.
endif; ?>
Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances.
“Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0,“ the vendor said in a security advisory. ”We had been working to backport the fix to the remaining supported versions when exploitation occurred.”
According to security firm watchTowr’s vulnerability FAQ, the flaw allowed remote attackers to spoof the signals used to establish a user’s identity, bypassing normal authentication checks. The bypass uses a path separate from normal authentication, so existing login protections do not stop it, watchTowr added.
Tracked as CVE-2026-104935 and rated at CVSS 8.6 out of 10, the vulnerability affects multiple product branches, including Ivanti Connect Secure 22.8R2.4 and earlier, as well as specified 25.1 releases. Ivanti says versions 22.7 and earlier are not affected.
Ivanti has released fixes, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and software branch. Security teams were advised to identify their deployed versions, apply corresponding fixes, and investigate potential compromise.
While Ivanti said reliable indicators of compromise were not yet available, Volexity, the cybersecurity firm credited with discovering the flaw, has published details of its exploitation. The US Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities (KEV) catalog on October 13.
.jpeg)
