Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(365566);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/15");

  script_cve_id("CVE-2026-104935");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/10/16");

  script_name(english:"Ivanti Connect Secure 22.8R2.x < 22.8R2.5 / 25.1.0.x / 25.1.1.x < 25.1.1.2 / 25.1.2.x < 25.1.3.0 Authentication Bypass (CVE-2026-104935)");

  script_set_attribute(attribute:"synopsis", value:
"A VPN solution installed on the remote host is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.5, 25.1.0.x or 25.1.1.x prior to
25.1.1.2, or 25.1.2.x prior to 25.1.3.0. It is, therefore, affected by an authentication bypass by spoofing
vulnerability:

  - An authentication bypass by spoofing in Ivanti Connect Secure allows a remote unauthenticated attacker to
    execute arbitrary commands. Ivanti states this does not impact version 22.7R2.14 or prior. (CVE-2026-104935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c46c57b3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Ivanti Connect Secure 22.8R2.5, 25.1.1.2 or 25.1.3.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-104935");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(290);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ivanti:connect_secure");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pulse_secure:connect_secure");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("pulse_connect_secure_detect.nbin");
  script_require_keys("installed_sw/Pulse Connect Secure");

  exit(0);
}

include('vcf_extras.inc');

var port = get_http_port(default:443, embedded:TRUE);
var app_info = vcf::pulse_connect_secure::get_app_info(app:'Pulse Connect Secure', port:port, full_version:TRUE, webapp:TRUE);

var constraints = [
  {'min_version':'22.8.2', 'fixed_version':'22.8.2.19315', 'fixed_display':'22.8R2.5'},
  {'min_version':'25.1', 'max_version':'25.1.1.15763', 'fixed_display':'25.1.1.2'},
  {'min_version':'25.1.2', 'fixed_version':'25.1.3.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);