Short answer: Attackers combined three Ivanti Connect Secure flaws, an authentication bypass, a remote code execution weakness, and a privilege escalation bug, to gain unauthenticated root-level access to VPN appliances. CISA added the two newly disclosed flaws to its Known Exploited Vulnerabilities catalog on October 30, 2026, and Ivanti has shipped fixes in versions 25.1.1.3 and 22.8R2.6. If you run Connect Secure, patch now, and if your appliance was exposed since early October, assume it may need deeper forensic checks.
This is a follow-up to the original Ivanti zero-day disclosed earlier in October. The first flaw got most of the attention, but the full picture only emerged when researchers at Volexity showed how all three flaws work together. Individually, two of the three bugs look limited. Chained together, they hand an attacker the keys to the appliance without any login at all.
What happened
On October 30, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two more Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The two flaws are CVE-2026-111357 and CVE-2026-118527. They join CVE-2026-104935, the authentication bypass added to the KEV catalog on October 13, 2026.
Volexity, the security firm that documented the attacks, found that a previously undocumented threat actor it tracks as UTA0576 began exploiting the chain on October 3, 2026, against an appliance that was fully patched at the time, running version 22.8R2.4. Ivanti says the attacks hit a limited number of customers, but the pattern matters for every Connect Secure operator: the chain worked against a patched device because the remaining flaws had not yet been fixed.
Ivanti shipped the fixes on October 29, 2026, in Connect Secure 25.1.1.3 and 22.8R2.6. Those releases close all three vulnerabilities that were chained and exploited in the wild.
The three flaws in the chain
An exploit chain is only as strong as the way its links connect. Here is what each flaw does, and why the combination is far more dangerous than any single bug.
1. CVE-2026-104935: the authentication bypass (CVSS 8.6)
This is the entry point. It lets a remote attacker bypass authentication on the appliance, which means no valid username or password is needed to start the attack. Ivanti disclosed this flaw on October 13, 2026, and had a fix already in testing when the other two flaws came to light. Rather than delay, Ivanti shipped the fix for this flaw first, saying it did not want to hold back protection for the primary exploitation path.
We covered this flaw in detail when it was first disclosed. Ivanti Connect Secure zero-day CVE-2026-104935
2. CVE-2026-118527: predictable file names (CVSS 4.3)
The second flaw is a predictable identifier weakness. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk, because the file names the appliance generates can be predicted. On its own, a CVSS score of 4.3 looks minor, and it requires an attacker to already have some authenticated access. In the chain, though, the authentication bypass supplies exactly that foothold, so the precondition effectively disappears.
3. CVE-2026-111357: missing authentication for a critical function (CVSS 8.8)
The third flaw is a privilege escalation bug: missing authentication for a critical function lets an attacker who already has a foothold on the appliance raise their privileges. This is the final link. Combined with the bypass and the file upload weakness, it turns limited access into full root-level code execution on the appliance.
As Volexity put it, the chain combined an authentication bypass, a remote code execution weakness, and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.
What the attackers actually did
What makes this incident unusual is what the attackers did after getting in. Unlike many VPN appliance attacks, which typically drop web shells or malware for persistent access, UTA0576 took a quieter approach.
According to Volexity, the actor extracted credentials stored on the VPN appliance and limited Active Directory metadata, conducted host reconnaissance, and searched for administrator passwords and BitLocker recovery keys. The payload also deleted recent entries from the appliance debug and audit logs, covering its tracks. Volexity found no web shell or first-stage malware, which means the attacker had to exploit the device again each time it wanted back in.
Volexity assesses with low confidence that the group is criminal rather than espionage-driven. Either way, the practical lesson is the same: credential theft from a VPN appliance can open doors far beyond the appliance itself, because VPN devices often hold the credentials that connect an organization network together.
Why the integrity checker may miss it
One of the most concerning findings is that Ivanti Integrity Checker Tool may not detect this compromise. Volexity reports that the chain patches library code in memory and restores configuration data afterwards, so the tool does not detect any modifications. CISA gave the same warning on October 13, noting that the tool may not detect evidence of exploitation.
In plain terms: running the integrity checker and getting a clean result does not prove your appliance is safe. If the device was internet-facing and unpatched during early October, a clean checker result should not be treated as an all-clear on its own.
Which versions are affected and what to install
Ivanti lists the following versions as affected:
- Connect Secure 25.1.1.2 and earlier, fixed in 25.1.1.3
- Connect Secure 22.8R2.5 and earlier, fixed in 22.8R2.6
Note that Ivanti had already patched part of this vulnerability in the July release 25.1.3.0 as part of its product security program, and was working to backport the fix to other supported versions when exploitation began. The October 29 releases are the ones that close the full chain across the supported lines.
Ivanti has also set end of life for the 22.8 line at January 31, 2027. If you are still on 22.8, plan your migration now rather than waiting for that deadline to force the issue.
CISA deadlines: November 2 and November 13
Federal Civilian Executive Branch agencies must apply the fixes by strict deadlines:
- CVE-2026-111357: November 2, 2026
- CVE-2026-118527: November 13, 2026
Those deadlines bind federal agencies, but every other organization should treat them as a patch-now queue. CISA only adds flaws to the KEV catalog when exploitation is confirmed, and the November 2 deadline for the privilege escalation flaw is only days away. If patching is delayed by change control, apply the fix to internet-facing appliances first.
What to do if your appliance was exposed
Patching closes the hole, but it does not answer whether someone already walked through it. Take these steps:
- Patch immediately to 25.1.1.3 or 22.8R2.6, depending on your line.
- Check the logs for the chain indicators. Volexity recommends watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi and checking /tmp/ for signs of post-exploitation activity.
- Do not rely on the integrity checker alone. On any device you suspect, Volexity recommends network and memory forensics.
- Rotate credentials. CISA advice for appliances that may have been hit is a factory reset plus new passwords, certificates, and API keys. At minimum, rotate any credentials stored on or passing through the appliance, including local administrator passwords and BitLocker recovery keys.
- Hunt beyond the appliance. Because the attackers searched Active Directory for admin passwords and recovery keys, review Active Directory for unusual access around the same period.
This pattern is not unique to Ivanti. VPN and edge devices are a recurring target because they sit at the network boundary and hold powerful credentials. Similar urgency applied to the following: Cisco SD-WAN zero-day, SonicWall SMA 1000 SSRF flaw, Citrix NetScaler zero-day
Why this chain matters beyond Ivanti customers
Three lessons stand out for anyone running edge infrastructure, not just Ivanti shops.
First, low-severity flaws are not low risk when chained. A CVSS 4.3 predictable-filename bug would rarely make headlines alone. Paired with an authentication bypass and a privilege escalation flaw, it became part of a root-level compromise. Risk assessments that look at flaws one at a time will miss chains like this.
Second, fully patched is a moving target. The victim appliance was fully patched at the time of attack, on 22.8R2.4, yet still fell to the chain, because the remaining fixes were still in development. Patching promptly matters, but so does monitoring for new disclosures affecting devices you already patched.
Third, detection tooling has blind spots by design. Memory-only patching that restores configuration afterwards is built to evade file-based integrity checks. Organizations that depend on a single detection method for edge devices should layer in network monitoring and log review, especially for internet-facing appliances.
Frequently asked questions
Is my Ivanti Connect Secure appliance affected?
If you run Connect Secure 25.1.1.2 or earlier, or 22.8R2.5 or earlier, yes. Update to 25.1.1.3 or 22.8R2.6 respectively.
Do I need all three flaws to be at risk?
The confirmed attacks used all three flaws chained together. Patching any one link breaks this specific chain, but the only complete fix is the October 29 release that closes all three, so update fully rather than partially.
What is the patch deadline?
U.S. federal agencies must fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. Other organizations should patch on the same urgency, starting with internet-facing appliances.
Will the Ivanti Integrity Checker Tool tell me if I was hacked?
Not reliably for this chain. Volexity and CISA both warn the tool may miss evidence of exploitation, because the attack patches library code in memory and restores configuration data. Use network and memory forensics on suspected devices.
What should I do if I suspect compromise?
Isolate the appliance, preserve logs and memory images for forensics, rotate credentials including local admin passwords and BitLocker recovery keys, and follow CISA guidance, which includes a factory reset and new passwords, certificates, and API keys for affected appliances.
Is the 22.8 line still supported?
Yes for now, with the fix in 22.8R2.6, but Ivanti puts end of life for the 22.8 line at January 31, 2027, so plan migration to a supported release.
The bottom line is straightforward: this was not a single bug but a working chain, it was exploited in the wild against a patched appliance, and the fixes are out now. Patch to 25.1.1.3 or 22.8R2.6, check for the indicators if your appliance was exposed in early October, and rotate anything the appliance could have exposed. The November 2 deadline leaves no room for a slow rollout on internet-facing devices.
Sources: The Hacker News (October 31, 2026), Cybersecurity ASEAN (October 31, 2026), reporting on Ivanti advisory, Volexity research, and CISA KEV catalog additions of October 30, 2026.