CVE-2026-104935 CrowdStrike LogScale · LogScale

Detect Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935) in CrowdStrike LogScale

Detects exploitation of CVE-2026-104935, an authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure. An unauthenticated remote attacker can spoof trusted authentication context to bypass access controls and obtain authenticated sessions without valid credentials. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The detection focuses on anomalous authentication events on Ivanti Connect Secure gateways: successful logins without preceding credential/MFA challenge, session establishment from untrusted or spoofed source context, admin/privileged access immediately following gateway-facing HTTP requests to authentication endpoints, and web request patterns targeting known ICS authentication handlers. Correlates VPN/gateway web proxy logs with authentication and session telemetry.

MITRE ATT&CK

Tactic
Initial Access Credential Access

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=/.*/ | repo=vpn
| event_platform=/.*/ 
| (vendor=/Ivanti/i OR product=/Connect Secure/i)
| case {
    ActivityName=/login succeeded|session established/i | AuthSuccess := 1 ;
    * | AuthSuccess := 0
  }
| case {
    ActivityName=/mfa|credential|certificate validated/i | CredSeen := 1 ;
    * | CredSeen := 0
  }
| AuthSuccess=1 AND CredSeen=0
| groupBy([SourceIP, UserName, ComputerName], function=[count(as=events), min(@timestamp, as=first), max(@timestamp, as=last)])
| events >= 1
| sort(last, order=desc)
high severity medium confidence

CrowdStrike Logscale/CQL query over ingested Ivanti Connect Secure logs flagging authentication successes with no corresponding credential or MFA event — the exploitation signature of CVE-2026-104935.

Data Sources

CrowdStrike Falcon LogScaleIvanti Connect Secure third-party log ingestion

Required Tables

vpn

False Positives & Tuning

  • SSO/SAML logins validated at an external identity provider
  • Certificate or device-trust authentication without a discrete credential event
  • Ingestion field-mapping gaps dropping credential events

Other platforms for CVE-2026-104935

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Simulate ICS auth-endpoint probe followed by session without credentials

    Expected signal: Web access log entry for /dana-na/auth/url_default/welcome.cgi and a syslog 'session established' event with no credential/MFA event for the same src_ip/user.

  2. Test 2 Rapid multi-user session establishment from single IP

    Expected signal: Four 'login succeeded' syslog events for four distinct users sharing src_ip 10.10.10.20 within one hour.

  3. Test 3 Admin page access immediately after spoofed session

    Expected signal: A credential-less session-established event for user=spoofed followed by an access log entry for /dana-admin/ from the same session/IP.

Last updated: 2026-10-14 Research depth: standard
References (1)

Response Playbook

Triage

  1. Confirm the affected gateway is an Ivanti Connect Secure appliance and identify its exact firmware/build to determine whether it falls within the CVE-2026-104935 affected range (check the Ivanti advisory for CVE-2026-104935 — affected versions were pending at disclosure).
  2. Pull the full authentication event chain for the flagged source IP and username and verify whether any legitimate credential, MFA, or certificate validation preceded the successful session; a genuine bypass shows a session with no credential proof.
  3. Correlate the source IP against threat intelligence and the appliance's web proxy/access logs for requests to /dana-na/auth/ endpoints and anomalous User-Agents immediately before the session was established.
  4. Determine what the spoofed session accessed — administrative pages (/dana-admin/), internal resources proxied through the gateway, or configuration changes.

Containment

  1. Isolate or take the affected Ivanti Connect Secure appliance offline from untrusted networks (or restrict the external interface via upstream firewall) until it is patched to the fixed build per Ivanti's CVE-2026-104935 advisory.
  2. Terminate all active sessions and force reauthentication; revoke and rotate any session tokens, admin credentials, and certificates that may have been exposed through the spoofed session.
  3. Block the identified attacker source IP(s) at the perimeter and add ICS auth endpoints to heightened monitoring.

Evidence Collection

  1. Export and preserve the appliance's authentication logs, web/access logs, and system event logs covering the suspected exploitation window; hash and store them offline.
  2. Capture a configuration snapshot and, if the appliance supports it, run the Ivanti Integrity Checker Tool (ICT) to detect tampering or implanted web shells, preserving its output.
  3. Collect packet captures or NetFlow for the gateway's external interface around the flagged timestamps to document the spoofing requests.

Escalation Criteria

  • !Escalate to incident response immediately if a session was established with no credential proof AND it accessed administrative functions or modified appliance configuration.
  • !Escalate if the Ivanti Integrity Checker Tool reports unexpected files/modifications or if outbound connections from the appliance to unknown hosts are observed, indicating post-exploitation implant.
  • !Escalate to management and consider regulatory/CISA notification given the CVE is in the KEV catalog and confirmed exploited in the wild.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >ICS appliance authentication and web/access logs showing session establishment without credential events
  • >Ivanti Integrity Checker Tool (ICT) output and any unexpected files under the appliance web root
  • >Active session table / session token store on the appliance
  • >Perimeter firewall and NetFlow records for the gateway external interface

Tuning Guidance

Baseline the normal ratio of credential/MFA events to successful sessions for your ICS deployment; SSO/SAML and certificate-based auth legitimately break the credential-then-session pairing and should be allowlisted by realm or auth method. Tune out health-check and load-balancer source IPs. If the IdP logs credential validation separately, join ICS session logs to IdP logs rather than treating a missing local credential event as suspicious. Tighten severity once the Ivanti advisory confirms affected builds and you can scope detection to vulnerable appliances.

Hunting Queries

Hunts for source IPs establishing an abnormal number of ICS sessions or authenticating as many distinct users within an hour — a sign of repeated bypass attempts.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor =~ "Ivanti" | where Activity has_any ("session established", "Login succeeded") | summarize logins=count(), users=dcount(DestinationUserName) by SourceIP, bin(TimeGenerated, 1h) | where logins > 5 or users > 3
Hunting — SPL
spl 
index=vpn sourcetype=ivanti:connectsecure (event="session established" OR event="login succeeded") | bucket _time span=1h | stats count AS logins dc(user) AS users by src_ip _time | where logins>5 OR users>3

Atomic Red Team Tests

Test 1 Simulate ICS auth-endpoint probe followed by session without credentials
linux

In a lab, send an unauthenticated request to the ICS welcome.cgi auth endpoint and inject a synthetic 'session established' log line with no preceding credential event to validate the correlation logic.

Command

bash 
curl -sk https://ics-lab.internal/dana-na/auth/url_default/welcome.cgi -A 'cve-2026-104935-test' -o /dev/null; logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session established user=attacker src_ip=10.10.10.10 realm=none'

Cleanup

bash 
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session terminated user=attacker src_ip=10.10.10.10'

Expected Telemetry

Web access log entry for /dana-na/auth/url_default/welcome.cgi and a syslog 'session established' event with no credential/MFA event for the same src_ip/user.

Expected Detection

The kql/spl rules flag the session-established event lacking a credential event for src_ip 10.10.10.10.

Test 2 Rapid multi-user session establishment from single IP
linux

Generate several synthetic ICS session-established events for distinct usernames from one source IP within a short window to exercise the hunting query thresholds.

Command

bash 
for u in alice bob carol dave; do logger -n siem-collector -P 514 -t ivanti "Ivanti Connect Secure: login succeeded user=$u src_ip=10.10.10.20"; done

Cleanup

bash 
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session cleanup src_ip=10.10.10.20'

Expected Telemetry

Four 'login succeeded' syslog events for four distinct users sharing src_ip 10.10.10.20 within one hour.

Expected Detection

The hunting query flags src_ip 10.10.10.20 for high distinct-user login count.

Test 3 Admin page access immediately after spoofed session
linux

Simulate access to an ICS admin path right after a credential-less session event to validate escalation triage for privileged access.

Command

bash 
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session established user=spoofed src_ip=10.10.10.30'; curl -sk https://ics-lab.internal/dana-admin/misc/admin.cgi -b 'DSID=spoofedsession' -o /dev/null

Cleanup

bash 
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session terminated user=spoofed src_ip=10.10.10.30'

Expected Telemetry

A credential-less session-established event for user=spoofed followed by an access log entry for /dana-admin/ from the same session/IP.

Expected Detection

Detection fires on the spoofed session and triage escalates due to administrative path access.

Related Detections

Tactic Hubs

TA0001 Initial Access TA0006 Credential Access

Related Techniques

T1190 Exploit Public-Facing Application T1133 External Remote Services T1078 Valid Accounts

Same Tactic: Initial Access

Popular Detections