An authentication bypass is normally a way past a login prompt. CVE-2026-104935 is a way past the assumption that a component reached without credentials is doing what its name says. The CVSS is 8.6, the CWE is 290, and the consequence is unauthenticated command execution on Ivanti Connect Secure.
What CWE-290 means in practice here
A routing mistake becomes an identity mistake. Requests to welcome.cgi can be steered so that they reach an arbitrary CGI handler, and that handler runs with the trust the unauthenticated entry point carries. No credential is stolen and no token is forged. The attacker arrives through a path meant to be pre-authentication and ends up somewhere that assumed a different caller.
The distinction matters for detection. Nothing in the flow resembles a failed login, because no login is attempted, so a signature built around credential abuse will not see it.
Affected and fixed versions
Affected: 22.8R2.4 and earlier, 25.1.1.1 and earlier, 25.1.2.2 and earlier
Fixed: 25.1.3.0, with additional fixes on 25.1.1.2 and 22.8R2.5
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on 13 October 2026, with a deadline of 16 October. Three days is the agency's way of saying the window has already opened.
What post-exploitation looks like
Reports from compromised appliances describe credential harvesting rather than immediate lateral movement. The targets are consistent: LDAP bind credentials held in configuration, Active Directory LAPS passwords, and BitLocker recovery keys. Those are precisely the secrets that move an attacker from an edge appliance into identity infrastructure without breaking anything visible.
Password spraying follows. An appliance holding a service account has handed over that account with its real permissions, from an attacker-controlled session that never had to authenticate to the appliance at all.
There is a second, quieter problem. Ivanti's integrity checker, which many teams treat as confirmation that an appliance is clean, has documented blind spots. Commands executed in memory, or activity that completes between checks, leave none of the artifacts the checker looks for. Reading a passing integrity check as evidence of no compromise is the wrong inference, and a common one.
A triage sequence
- 1.
Establish the build first.
22.8R2.4,25.1.1.1and25.1.2.2are the boundaries, and appliances are commonly managed in pairs, so check the secondary as well as the primary. - 2.
Assume secrets are exposed until proven otherwise. Rotate LDAP bind credentials, machine account passwords, and every account whose LAPS and BitLocker material the appliance could read. Do it even where the integrity checker reports clean, because the checker does not cover in-memory activity.
- 3.
Hunt the routing abuse, not the credential abuse. The interesting requests are those that arrive at CGI paths through an unexpected route, especially where the source address has no prior session and the request never produced a login event.
- 4.
Reduce admin-facing reachability. Fewer internet paths to the management interface means fewer versions of this bypass that matter.
Why this class keeps recurring
Ivanti Connect Secure has been on the receiving end of this pattern repeatedly, and CWE-290 explains why. A remote access appliance is a large body of code whose entire job is deciding, from incomplete information, whether an incoming request should be trusted. Every new entry point inherits that decision. When routing logic lets a request reach a handler that holds a different assumption about who is calling, the result is a bypass that no password policy addresses.
The lesson is architectural. Assume that any component reachable before authentication will eventually be reached in a way its author did not intend, and put detection where it can observe routing rather than credentials.
References
Ivanti security advisory for CVE-2026-104935 (see Ivanti's security advisory portal)
CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-104935, added 13 October 2026