Exploiting CVE-2026-104935: Ivanti Connect Secure Authentication Bypass and RCE

Ivanti Connect Secure, a widely deployed VPN solution, was recently impacted by a critical vulnerability known as CVE-2026-104935, which allows attackers to bypass authentication and achieve remote code execution (RCE). This vulnerability poses significant risk given Ivanti’s deployment in enterprise environments where unauthorized access could lead to severe data breaches and network compromise.

This campaign leverages the vulnerability to take control of systems by bypassing security checks, executing arbitrary commands, and compromising sensitive data. Originally identified in mid-2026, the exploit has been associated with various threat actors targeting financial and government sectors, seeking to exploit these gateways into hybrid infrastructures.

Understanding the intricacies of the CVE-2026-104935 vulnerability in Ivanti Connect Secure reveals critical insights into how authentication bypass can facilitate broader network compromises.

How It Was Built

The exploitation of CVE-2026-104935 is characterized by the following technical breakdown: attackers constructed an infrastructure capable of impersonating legitimate Ivanti authentication processes. They leveraged domain names designed to closely resemble the target organization’s infrastructure, often employing internationalized domain names (IDNs) to visually deceive victims.

The attack chain typically begins with a phishing email or social engineering call leading users to a spoofed authentication portal, indistinguishable from legitimate access points. Here, attackers exploit the vulnerability to bypass normal authentication, gain high-level user privileges, and deliver RCE payloads.


POST /dana-na/auth/url_admin/custom.cgi HTTP/1.1

Host: secure-login.yourcompany.com

Content-Type: application/x-www-form-urlencoded

Content-Length: 146



action=login&username=exploiter&password=<exploit_code>&realm=internal

The payload is crafted to exploit specific gaps in input validation, allowing malicious code execution on the server-side through manipulated session tokens.

Why It Worked

The success of this campaign can be attributed to several key factors. Firstly, the choice of spoofed domains made the attack visually indistinguishable from legitimate company portals, significantly increasing victim engagement rates. This visual spoofing was enhanced by utilizing SSL certificates from compromised or malicious certificate authorities to maintain HTTPS integrity.

Furthermore, the exploit leveraged sophisticated payload obfuscation, embedding malicious code within legitimate-looking network traffic. This was crucial in evading detection by automated security tools, allowing the attacker to execute arbitrary code unnoticed.

Operator Takeaways

For red teamers, replicating the success of this campaign involves a focus on high-fidelity spoofing and credential interception. Craft exploit chains that mimic genuine user activity closely, building believable narratives around the proposed actions. Investigating and deploying multi-vector approaches, including social engineering lures and technical infrastructure planting, heightens the effectiveness of the exploitation strategy.

Good / Better / Best

Good: Utilizing effective domain spoofing can establish initial access convincingly.

Better: Enhancing payload delivery with obfuscation techniques and leveraging HTTPS across spoofing endpoints to maintain user confidence.

Best: Combining social engineering with technical exploitation of CVE-2026-104935, ensuring end-to-end deception from lure creation to payload execution.

References: