Spoofing is not stealing: the CVE-2026-104935 authentication problem
Spoofing is not stealing: the CVE-2026-104935 authentication problem A distinction that changes the response Most authentication incidents involve a credential that was supposed to work. A password is reused, a token is stolen, a session is hijacked. CVE-2026-104935 belongs to a different category. Ivanti classifies it as CWE-290, authentication bypass by spoofing, which means the attacker never…
Spoofing is a unique authentication issue unlike typical cases involving stolen or reused credentials, as stated by Ivanti. The vulnerability CVE-2026-104935 allows a remote attacker to execute commands on Ivanti Connect Secure without needing a valid credential. This is achieved by influencing a value the system trusts during the authentication process.
Once the system approves this manipulated value, it treats the session as authenticated, granting the attacker unfettered access. The flaw, classified as CWE-290, cyber weakness, doesn't require any legitimate credentials, making password resets, token revocations, or stronger authentication factors ineffective. Ivanti addressed the issue in a specific build, but the vulnerability still affects numerous internet-facing Ivanti Connect Secure instances, totaling over 16,000.
The true remedy lies in installing the fixed build and monitoring logs for potential breaches, as traditional credential detection will not flag the attack.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
