What CVE-2026-104935 Actually Does
Start with the ugly facts, because the headline is genuinely bad. Ivanti Connect Secure (ICS) carries a flaw — CVE-2026-104935 — classified as authentication bypass by spoofing (CWE-290). In plain terms, a remote attacker with zero valid credentials can present spoofed authentication material, get the appliance to trust them, and then execute arbitrary commands on the box. That's an unauthenticated, network-reachable path to command execution on a device that usually sits on the perimeter and happily hands out routes into your internal network. The published CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, an 8.6 High score, with the big confidentiality impact telling the real story.
The numbers alone would be enough to escalate, but two external signals turn up the heat. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-13, and the CISA ADP enrichment records Exploitation as active, Automatable as yes, and Technical Impact as total. Total impact is not a score you argue with. Treat this as a live-fire problem, not a backlogged ticket.
The July Patch That Left a Path Open
Here's the part that should make patch managers squirm. Coverage of this flaw — including Security Arsenal's remediation write-up and the Dark Reading reporting that brought it attention — describes a July update that addressed the code-execution component of the chain but incompletely closed the authentication-bypass route that feeds into it. A patch applied is not a vulnerability closed.
That distinction is doing a lot of work. Organizations that dutifully ran the July update may have every reason to believe they're covered. They may be wrong, and the worst part is the false comfort actively suppresses the investigation you should be running. Threat actors, being unbothered by good intentions, found the residual surface and started using it.
I want to flag one evidence caveat so I'm not overselling: the July-partial-patch framing comes primarily from Security Arsenal's analysis and reporting. The vendor advisory itself did not render for me at fetch time, so confirm the exact fix builds against Ivanti's own advisory portal before you certify any fleet.
How the Exploit Chain Works
Two links make the chain. First, the spoofing-based bypass hands the attacker a foothold without ever knowing a password. Second, code execution lets them run things, dropped webshells in the web root, outbound wget/curl fetches, base64-decoded payloads, scheduled persistence that survives a reboot. The attacker's playbook then drifts toward the things every edge breach eventually reaches: command execution and tool transfer, which map to MITRE ATT&CK T1059 and T1105, and lateral movement out of the VPN address pool via SMB or RDP, which maps to T1021 and T1078. A breached concentrator is a credential factory, and the harvested material gets reused against the internal hosts that appliance was allowed to reach.
Why This Fits Broader AI Cybersecurity Threats in 2026
Call it the 2026 tax on edge devices. The same week's Ivanti Sentry incidents and earlier Citrix NetScaler web-shell intrusions all rhyme: internet-facing appliances, fast weaponization, and attackers who scan the entire exposed estate before an admin finishes the advisory. Agentic tooling has compressed that discovery-to-exploit window, and defenders chasing one-off CVEs are the latest chapter in a wider set of AI cybersecurity threats where automation on the attack side simply moves faster than patch queues on ours. The lesson is structural, not specific to Ivanti, the rapid attack cycle on Ivanti Sentry is the same speedrun pattern applied to a different product.
Affected Versions and the Good News
The version math matters more than usual here. Per the CVE record mirrored on OpenCVE, releases before 25.1.3.0 are vulnerable, while version 22.7R2.14 and prior are not impacted. The fixed/unaffected builds listed in the advisory data are 25.1.3.0, 25.1.3.1, 22.8R2.5, and 22.7R2.14. So a fleet sitting on the old 22.7R2.x line can exhale; a fleet that auto-updated only to the July build is exactly where the residual risk concentrates. Pull each appliance's exact build number and compare it to the vendor's follow-on advisory that closes the authentication-bypass component, not the July one.
Detection: Spotting the Compromise
Detection is where most teams have already lost, because edge appliances log poorly and get reset by "quick fixes." Run the Ivanti Integrity Checker Tool (ICT) and treat any anomaly as an incident trigger, not a maintenance note. Review admin and event logs for gaps, missing log windows are themselves a signal, since attackers that land with code execution delete their tracks. Audit local user accounts and certificate stores for unauthorized additions, and inspect the web root for unexpected files. If you don't expose SSH on these boxes (and you shouldn't), pull ICT output through the admin console instead.
Remediation Without the False Comfort
Work the steps in order, because speed matters against an unauthenticated, internet-facing path. Verify the complete fix, not the July partial. Assume compromise for any appliance that was internet-reachable during the gap window, patching alone will not evict persistence that survives reboots. If integrity checks fail or logs are missing, factory-reset and rebuild from a known-good image; rotating credentials on a still-persisted box accomplishes almost nothing. Rotate everything the appliance touches: VPN user credentials, service accounts, RADIUS/LDAP bind accounts, appliance admin credentials, API tokens, and stored keys. Cut the permanent attack surface, management interface off the public internet, MFA on all VPN access, segmented VPN pools that can't reach server management ports directly.
The Patch Assurance Lesson
Strip away the CVE number and CVE-2026-104935 is a process failure dressed as a software failure. "Patched" has to mean verified against the complete fix, checked by version and retested against the exploit path, not "we ran something in July." Bake that post-patch validation into your vulnerability-management SLA for every internet-facing appliance, and track CISA KEV for binding deadlines and prioritization. That's the one durable win this particular mess can buy you.
