Spoofing is not stealing: the CVE-2026-104935 authentication problem

A distinction that changes the response

Most authentication incidents involve a credential that was supposed to work. A password is reused, a token is stolen, a session is hijacked. CVE-2026-104935 belongs to a different category. Ivanti classifies it as CWE-290, authentication bypass by spoofing, which means the attacker never needed a working credential in the first place.

How the bypass works

In a spoofing-based bypass the system makes its authentication decision from a value the caller controls or influences. The gateway evaluates the claim, finds it acceptable, and treats the session as authenticated. There is no password to reset and no token to revoke, because no valid authentication material was ever involved.
Ivanti's advisory states the outcome plainly: a remote, unauthenticated attacker can execute arbitrary commands on the appliance. The flaw carries a CVSS score of 8.6 and affects Ivanti Connect Secure.

Why credential controls do not close it

Organizations that respond to authentication incidents by forcing password resets, revoking tokens and enabling stronger factors are applying the right controls to the wrong problem. Those measures assume the attacker used credentials that the organization can invalidate. Here the decision logic itself is unsound, so the remedy is the vendor's fixed build.
That is also why multi-factor authentication does not automatically help. If the gateway decides the session is already authenticated before any factor is requested, a second factor never enters the flow.

Affected releases

Connect Secure 25.1.1.1 and prior, fixed in 25.1.1.2.
Connect Secure 25.1.2.2 and prior, fixed in 25.1.3.0 and 25.1.3.1.
Connect Secure 22.8R2.4 and prior, fixed in 22.8R2.5. Ivanti notes the flaw does not affect ICS version 22.7R2.14 or prior.

Exploitation and response

Ivanti disclosed the flaw on October 13, 2026 and confirmed exploitation in the wild against a limited number of customers, crediting Volexity. The correct response is to install a fixed build and review logs for signs of compromise, since credential-based detection will not reveal an attack that never used credentials.

Exposed population

A ZoomEye query for app="Ivanti Connect Secure" && port="443" returned 16,830 matching internet-facing instances, which describes exposed deployments of this product rather than confirmed vulnerable hosts.