Exploiting CVE-2026-104935: Ivanti Connect Secure Authentication Bypass

Campaign or TTP Overview

In early 2026, a critical vulnerability designated as CVE-2026-104935 was uncovered in Ivanti Connect Secure, a VPN solution used by enterprises around the world to provide remote access to their networks. This vulnerability, identified in the authentication component of the system, allows malicious actors to bypass security checks by crafting specially forged requests. The attack was widely reported and is believed to have been exploited by APT groups targeting high-value enterprises, particularly in the finance and technology sectors.

The exploitation of CVE-2026-104935 was first observed in February 2026, with attacks reportedly originating from skilled cyber espionage groups that typically focus on unauthorized access and data exfiltration. The attack vector allowed the bypassing of authentication, facilitating unauthorized command execution on the affected systems, ultimately compromising sensitive data and administrative controls.

Key affected sectors included financial institutions and tech companies with enterprise-grade operations relying on Ivanti’s Connect Secure technology for secure communications. Despite rapid reporting and releases of patches, the window before patch application provided ample opportunity for exploitation, resulting in substantial initial success for attackers.

How It Was Built

The technical construct of the attack began with the setup of a dedicated command and control (C2) infrastructure that would eventually serve spoofed authentication requests. The attackers meticulously crafted emails to appear as legitimate Ivanti or internal IT communications, utilizing carefully forged sender names and domain patterns to increase credibility. Example domains included:


support-ivanticsecure.com

security-alerts-itgroup.com

Delivery mechanisms primarily revolved around phishing emails with subjects such as: Important: Immediate VPN Security Update Required. The body of these emails was designed to instill urgency and included a “security patch” hosted on the attacker-controlled domain.

Once a target engaged with the initial phishing attempt, typically by clicking the embedded link, they were redirected to a fake login page identical to the legitimate Ivanti login interface. Credentials entered here were harvested in real-time and immediately utilized to forge command execution requests on the affected Ivanti system. These requests exploited the authentication bypass vulnerability by injecting specific malformed input:


GET /dana-na/auth/url_default/welcome.cgi HTTP/1.1

Host: support-ivanticsecure.com

Authorization: Basic [malformed-header]

Why It Worked

Several factors contributed to the success of this campaign. First, the legitimacy of spoofed email domains lent immediate credibility to phishing attempts. By closely imitating trusted communication channels, these messages bypassed initial suspicion, making engagement likely among unwary targets.

The urgency imparted in the phishing emails, framed under the guise of a critical security update, exploited common psychological triggers that prioritize immediate response over careful scrutiny. Speed and fear of disruption motivated users to follow the embedded links without proper verification.

The fake Ivanti login portals were crafted with exceptional detail, replicating legitimate styling and functionality, which further enhanced the deception. The high fidelity of these pages reduced awareness of any ongoing attack, allowing smooth credential capture.

Operator Takeaways

For red teams, dissecting this campaign reveals several actionable insights. First, focus on the authenticity of replica communication channels. Precise mimicry of legitimate branding in phishing setups dramatically increases the likelihood of engagement.

Additionally, leveraging psychological triggers, such as urgency or fear of security lapses, can effectively prompt user action with minimal skepticism. Fine-tuning these elements in your own campaigns can lead to higher engagement rates.

Finally, investing in high-quality clone pages can successfully harvest and leverage credentials for further post-exploitation activities. Attention to detail in these clones can mean the difference between purely capturing credentials and enabling seamless further action.

Do’s and Don’ts

Do use authentic-looking domain names to enhance credibility.
Do capitalize on natural psychological responses by instilling urgency in your communications.
Don’t overlook the importance of exact replica phishing pages; poor quality can raise suspicion too soon.
Don’t rely solely on email phishing; diversify your delivery vector to include multifaceted approaches like direct communication channels.