Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)

Catalog analysis: CISA added this entry on October 13, 2026. The entry reflects catalog information retrieved on October 13, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-104935 is an authentication bypass vulnerability (CWE-290) affecting Ivanti Connect Secure. This flaw allows a remote, unauthenticated attacker to spoof identity and execute arbitrary commands on the system. Because these gateways often sit at the perimeter of a network, such a vulnerability could provide an entry point for unauthorized access to internal systems.

Exposure and applicability

This vulnerability is particularly relevant to U.S. healthcare providers, health plans, and business associates that utilize Ivanti Connect Secure as a VPN or secure gateway. These devices are frequently used to facilitate remote access for clinicians, administrative staff, and third-party vendors accessing electronic Protected Health Information (ePHI) or clinical applications. An attacker successfully exploiting this bypass could potentially gain a foothold in the healthcare environment, threatening the confidentiality of patient data and the operational resilience of care delivery systems.

Remediation priorities

Based on our analysis of the vulnerability’s impact on healthcare infrastructure, we suggest the following prioritized actions:

1. Immediate Mitigation Deployment: Security leaders should prioritize applying mitigations exactly as prescribed by the vendor. This is the primary method to reduce the likelihood of initial compromise via this specific bypass.
2. Forensic Triage: Because this vulnerability allows remote command execution, we recommend that security teams perform forensic triage according to vendor and CISA requirements. This is intended to detect if the system has already been compromised, as mitigations alone do not remove an existing attacker.
3. Exposure Assessment: Network administrators should evaluate the internet exposure of all Ivanti Connect Secure assets to ensure that only necessary interfaces are accessible and that mitigations are applied across all exposed instances.

How to validate remediation

To verify that the risk has been reduced, organizations should use the following methods:
* Configuration Audit: Confirm through administrative consoles or vendor-provided tools that the specific mitigations for CVE-2026-104935 have been successfully applied.
* Triage Documentation: Review the results of the forensic triage process to ensure no indicators of compromise were found prior to or following the mitigation application.

Note: A version check alone does not guarantee that a system is secure or free from existing compromise.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, while CISA has established a deadline for federal agencies, private healthcare entities must determine their own patching timelines based on their internal risk management frameworks and the criticality of the affected systems to patient care. There is residual risk if forensic triage is not completed, as an attacker may have already established persistence before mitigations were applied.

Source and editorial note

CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability · Source date: October 13, 2026 · Retrieved October 13, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment