Detect Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935) in Splunk
Detects exploitation of CVE-2026-104935, an authentication bypass by spoofing vulnerability (CWE-290) in Ivanti Connect Secure. An unauthenticated remote attacker can spoof trusted authentication context to bypass access controls and obtain authenticated sessions without valid credentials. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The detection focuses on anomalous authentication events on Ivanti Connect Secure gateways: successful logins without preceding credential/MFA challenge, session establishment from untrusted or spoofed source context, admin/privileged access immediately following gateway-facing HTTP requests to authentication endpoints, and web request patterns targeting known ICS authentication handlers. Correlates VPN/gateway web proxy logs with authentication and session telemetry.
MITRE ATT&CK
- Tactic
- Initial Access Credential Access
SPL Detection Query
index=vpn (sourcetype="ivanti:connectsecure" OR sourcetype="pulse:connectsecure" OR vendor="Ivanti")
| eval auth_success=if(match(event, "(?i)(login succeeded|authentication success|session established)"),1,0)
| eval cred_seen=if(match(event, "(?i)(mfa|password|credential|certificate validated|realm)"),1,0)
| transaction src_ip user maxspan=2m
| where auth_success=1 AND cred_seen=0
| stats count AS events min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS urls values(event) AS activities by src_ip user host
| where events>=1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seenIdentifies ICS authentication successes with no correlated credential/MFA event within the session window, indicating spoofed authentication context per CVE-2026-104935.
Data Sources
Required Sourcetypes
False Positives & Tuning
- SAML/SSO logins whose credential validation is logged only at the external IdP
- Certificate or device-trust authentication that does not log a discrete credential event
- Reconnect/session-resume events that reuse an existing authenticated session
Other platforms for CVE-2026-104935
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulate ICS auth-endpoint probe followed by session without credentials
Expected signal: Web access log entry for /dana-na/auth/url_default/welcome.cgi and a syslog 'session established' event with no credential/MFA event for the same src_ip/user.
- Test 2 Rapid multi-user session establishment from single IP
Expected signal: Four 'login succeeded' syslog events for four distinct users sharing src_ip 10.10.10.20 within one hour.
- Test 3 Admin page access immediately after spoofed session
Expected signal: A credential-less session-established event for user=spoofed followed by an access log entry for /dana-admin/ from the same session/IP.
References (1)
Response Playbook
Triage
- Confirm the affected gateway is an Ivanti Connect Secure appliance and identify its exact firmware/build to determine whether it falls within the CVE-2026-104935 affected range (check the Ivanti advisory for CVE-2026-104935 — affected versions were pending at disclosure).
- Pull the full authentication event chain for the flagged source IP and username and verify whether any legitimate credential, MFA, or certificate validation preceded the successful session; a genuine bypass shows a session with no credential proof.
- Correlate the source IP against threat intelligence and the appliance's web proxy/access logs for requests to /dana-na/auth/ endpoints and anomalous User-Agents immediately before the session was established.
- Determine what the spoofed session accessed — administrative pages (/dana-admin/), internal resources proxied through the gateway, or configuration changes.
Containment
- Isolate or take the affected Ivanti Connect Secure appliance offline from untrusted networks (or restrict the external interface via upstream firewall) until it is patched to the fixed build per Ivanti's CVE-2026-104935 advisory.
- Terminate all active sessions and force reauthentication; revoke and rotate any session tokens, admin credentials, and certificates that may have been exposed through the spoofed session.
- Block the identified attacker source IP(s) at the perimeter and add ICS auth endpoints to heightened monitoring.
Evidence Collection
- Export and preserve the appliance's authentication logs, web/access logs, and system event logs covering the suspected exploitation window; hash and store them offline.
- Capture a configuration snapshot and, if the appliance supports it, run the Ivanti Integrity Checker Tool (ICT) to detect tampering or implanted web shells, preserving its output.
- Collect packet captures or NetFlow for the gateway's external interface around the flagged timestamps to document the spoofing requests.
Escalation Criteria
- !Escalate to incident response immediately if a session was established with no credential proof AND it accessed administrative functions or modified appliance configuration.
- !Escalate if the Ivanti Integrity Checker Tool reports unexpected files/modifications or if outbound connections from the appliance to unknown hosts are observed, indicating post-exploitation implant.
- !Escalate to management and consider regulatory/CISA notification given the CVE is in the KEV catalog and confirmed exploited in the wild.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
ICS appliance authentication and web/access logs showing session establishment without credential events - >
Ivanti Integrity Checker Tool (ICT) output and any unexpected files under the appliance web root - >
Active session table / session token store on the appliance - >
Perimeter firewall and NetFlow records for the gateway external interface
Tuning Guidance
Baseline the normal ratio of credential/MFA events to successful sessions for your ICS deployment; SSO/SAML and certificate-based auth legitimately break the credential-then-session pairing and should be allowlisted by realm or auth method. Tune out health-check and load-balancer source IPs. If the IdP logs credential validation separately, join ICS session logs to IdP logs rather than treating a missing local credential event as suspicious. Tighten severity once the Ivanti advisory confirms affected builds and you can scope detection to vulnerable appliances.
Hunting Queries
Hunts for source IPs establishing an abnormal number of ICS sessions or authenticating as many distinct users within an hour — a sign of repeated bypass attempts.
CommonSecurityLog | where DeviceVendor =~ "Ivanti" | where Activity has_any ("session established", "Login succeeded") | summarize logins=count(), users=dcount(DestinationUserName) by SourceIP, bin(TimeGenerated, 1h) | where logins > 5 or users > 3index=vpn sourcetype=ivanti:connectsecure (event="session established" OR event="login succeeded") | bucket _time span=1h | stats count AS logins dc(user) AS users by src_ip _time | where logins>5 OR users>3Atomic Red Team Tests
In a lab, send an unauthenticated request to the ICS welcome.cgi auth endpoint and inject a synthetic 'session established' log line with no preceding credential event to validate the correlation logic.
Command
curl -sk https://ics-lab.internal/dana-na/auth/url_default/welcome.cgi -A 'cve-2026-104935-test' -o /dev/null; logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session established user=attacker src_ip=10.10.10.10 realm=none'Cleanup
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session terminated user=attacker src_ip=10.10.10.10'Expected Telemetry
Web access log entry for /dana-na/auth/url_default/welcome.cgi and a syslog 'session established' event with no credential/MFA event for the same src_ip/user.
Expected Detection
The kql/spl rules flag the session-established event lacking a credential event for src_ip 10.10.10.10.
Generate several synthetic ICS session-established events for distinct usernames from one source IP within a short window to exercise the hunting query thresholds.
Command
for u in alice bob carol dave; do logger -n siem-collector -P 514 -t ivanti "Ivanti Connect Secure: login succeeded user=$u src_ip=10.10.10.20"; doneCleanup
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session cleanup src_ip=10.10.10.20'Expected Telemetry
Four 'login succeeded' syslog events for four distinct users sharing src_ip 10.10.10.20 within one hour.
Expected Detection
The hunting query flags src_ip 10.10.10.20 for high distinct-user login count.
Simulate access to an ICS admin path right after a credential-less session event to validate escalation triage for privileged access.
Command
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session established user=spoofed src_ip=10.10.10.30'; curl -sk https://ics-lab.internal/dana-admin/misc/admin.cgi -b 'DSID=spoofedsession' -o /dev/nullCleanup
logger -n siem-collector -P 514 -t ivanti 'Ivanti Connect Secure: session terminated user=spoofed src_ip=10.10.10.30'Expected Telemetry
A credential-less session-established event for user=spoofed followed by an access log entry for /dana-admin/ from the same session/IP.
Expected Detection
Detection fires on the spoofed session and triage escalates due to administrative path access.