{"id":10005,"date":"2026-10-14T11:46:45","date_gmt":"2026-10-14T11:46:45","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10005"},"modified":"2026-10-14T11:46:45","modified_gmt":"2026-10-14T11:46:45","slug":"hackers-abuse-the-ivanti-connect-secure-bug-to-gain-access-without-accounts","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10005","title":{"rendered":"Hackers abuse the Ivanti Connect Secure bug to gain access without accounts"},"content":{"rendered":"<div>\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column \">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<div class=\"container\"><\/div>\n<p class=\"wp-block-paragraph\">Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances.<\/p>\n<p class=\"wp-block-paragraph\">\u201cIvanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0,\u201c the vendor said in a <a href=\"https:\/\/hub.ivanti.com\/s\/article\/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US\" target=\"_blank\" rel=\"noopener\">security advisory<\/a>. \u201dWe had been working to backport the fix to the remaining supported versions when exploitation occurred.\u201d<\/p>\n<p class=\"wp-block-paragraph\">According to security firm watchTowr\u2019s vulnerability <a href=\"https:\/\/watchtowr.com\/intelligence\/ivanti-connect-secure-cve-2026-104935-faq\/\" target=\"_blank\" rel=\"noopener\">FAQ<\/a>, the flaw allowed remote attackers to spoof the signals used to establish a user\u2019s identity, bypassing normal authentication checks. The bypass uses a path separate from normal authentication, so existing login protections do not stop it, watchTowr added.<\/p>\n<p class=\"wp-block-paragraph\">Tracked as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/cve-2026-104935\" target=\"_blank\" rel=\"noopener\">CVE-2026-104935<\/a> and rated at CVSS 8.6 out of 10, the vulnerability affects multiple product branches, including Ivanti Connect Secure 22.8R2.4 and earlier, as well as specified 25.1 releases. Ivanti says versions 22.7 and earlier are not affected.<\/p>\n<p class=\"wp-block-paragraph\">Ivanti has released fixes, including for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the hardware and software branch. Security teams were advised to identify their deployed versions, apply corresponding fixes, and investigate potential compromise. <\/p>\n<p class=\"wp-block-paragraph\">While Ivanti said reliable indicators of compromise were not yet available, Volexity, the cybersecurity firm credited with discovering the flaw, has published details of its exploitation. The US Cybersecurity and Infrastructure Security Agency <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935\" target=\"_blank\" rel=\"noopener\">added<\/a> the flaw to its known exploited vulnerabilities (KEV) catalog on October 13.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances. \u201cIvanti initially discovered a portion of this vulnerability as part of our product security program and patched it in [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":10006,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10005","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10005"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10005"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10005\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10006"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}