Federal cybersecurity authorities have updated the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, issuing an emergency patch mandate for a newly identified remote access gateway zero-day. Threat actors actively exploit header spoofing errors to bypass authentication logic and gain root access to internal networks.
The vulnerability, tracked as CVE-2026-104935, affects Ivanti Connect Secure ICS gateways. The defect stems from improper validation of HTTP header parameters during remote session negotiation. Unauthenticated remote adversaries transmit malformed HTTP connection requests to bypass gateway authentication handlers, obtaining administrative root access without valid credentials. Threat reports confirm nation-state actors actively weaponized the flaw as a zero-day since early October to deploy web shells and intercept encrypted VPN traffic.
Subverting secure remote access gateways destroys perimeter boundary protections across enterprise networks. Because Ivanti Connect Secure appliances manage single sign-on user sessions and SSL VPN tunnel terminations, an unauthenticated gateway takeover permits adversaries to harvest active user session tokens, inspect unencrypted transit traffic, and pivot directly into backend corporate networks.
– Upgrade Ivanti Connect Secure appliances immediately to official vendor-supplied emergency fixed release builds.
– Run the official Ivanti Integrity Checking Tool ICT across gateway appliances to inspect for unauthorized web shell implants.
– Restrict public internet visibility of Ivanti management interfaces by placing control panels on dedicated VLANs.
– Invalidate active VPN user session tokens and execute mandatory administrative credential resets across managed appliances.
Perimeter access controller defense demands emergency patch execution and continuous integrity checking to ensure secure access gateways remain completely protected from unauthenticated zero-day takeover. #CodeDefence #Ivanti #ConnectSecure #CISA #KEV #ZeroDay #AuthBypass #NetworkSecurity #AppSec
/
