Attackers chained an October Ivanti Connect Secure flaw with two more, CVE-2026-111357 and CVE-2026-118527, to get root on gateways that were fully patched at the time. CISA's federal deadline for the root flaw is November 2. Fixed builds are 22.8R2.6, 25.1.1.3 and 25.1.3.1.
If your company’s remote access runs through an Ivanti Connect Secure VPN gateway, it needs Ivanti’s latest build today, and a clean scan from Ivanti’s own checker is no longer proof the box is safe. Attackers chained three flaws to get root on gateways that were fully patched when they were hit. Ivanti has now fixed the last two, and CISA added both to its list of exploited vulnerabilities on October 30.
What changed
The attack starts with CVE-2026-104935, an authentication bypass (CVSS 8.6) that Ivanti patched on October 13. Volexity, the security firm that found the attacks, showed in its technical write-up that a group it tracks as UTA0576 paired that bug with two more to run commands as root. At the time, one of those two had no fix.
The two flaws added on October 30:
- CVE-2026-111357 (CVSS 7.0). A privilege escalation to root. Ivanti’s background broker process trusts configuration data it should not, according to the NVD entry. Volexity says Ivanti published the fix on October 29.
- CVE-2026-118527. CISA catalogs it as a “generation of predictable numbers or identifiers” flaw. BleepingComputer reports that it lets an authenticated attacker upload files to an unpatched device.
The Canadian Centre for Cyber Security, updated October 30, lists Connect Secure as affected before versions 22.8R2.6, 25.1.1.3 and 25.1.3.1. Those are the builds to be on. Ivanti’s advisory carries the vendor’s own version table.
CISA’s Known Exploited Vulnerabilities catalog gives US federal agencies until November 2 to fix CVE-2026-111357 and until November 13 for CVE-2026-118527. The deadline binds federal agencies only. It is still the clearest signal of how urgent CISA thinks this is.
How the attackers hid
Volexity’s findings are what make this one harder to clean up:
- No malware, no web shell. The attacker re-ran the exploit for every command instead of leaving a tool behind.
- Logs were edited. The debug and audit logs on the appliance were truncated, and Volexity says Ivanti’s Integrity Checker Tool may not detect the compromise.
- Credentials were the target. On the gateway Volexity examined, the attacker reached domain credentials used for LDAP, LAPS local admin passwords and BitLocker recovery keys.
Exploitation goes back to at least October 3 by Volexity’s count. Defused, another firm, told BleepingComputer it saw the first signs on October 1. Shadowserver tracks more than 5,000 Connect Secure gateways exposed to the internet, according to BleepingComputer. It has not said how many are patched.
What to do now
1. Update every Connect Secure gateway to 22.8R2.6, 25.1.1.3 or 25.1.3.1, or later, using Ivanti’s advisory to pick the right branch.
2. Don’t treat a clean Integrity Checker result as the end of it. Volexity published the signs to look for: heavy traffic to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, a process named dsstatmond, a hidden /data/.icscap folder, and gaps in the debug and audit logs.
3. If the gateway was exposed and unpatched after October 1, plan for credential rotation. Volexity does not prescribe this step. Our read of its findings is that the LDAP service account, LAPS passwords and BitLocker recovery keys the appliance could reach should be treated as exposed until proven otherwise.
4. If you only use the VPN, you have nothing to install on your laptop for this. Expect a forced reconnect or a password reset from IT, and treat any unexpected request for your credentials by phone or email with suspicion.
A clean Integrity Checker scan no longer proves much
BleepingComputer counts at least four earlier rounds of exploited Connect Secure flaws since January 2024, and CISA’s catalog now lists 38 Ivanti vulnerabilities as exploited. The new part is the method: a fully patched box, no files left behind, and logs edited to fool the vendor’s own checker. For a small company with one VPN gateway and no security team, that changes the job. Patching closes the door, but it does not tell you whether someone walked through it in October. Budget a few hours for the log and credential review, or ask whoever manages the appliance to do it this week. The same lesson came up with the Northflank breach and its exposed AI API keys and TeamViewer’s host-to-viewer flaw: tools that sit between you and your systems need their own patch owner.
Primary sources: Volexity, Canadian Centre for Cyber Security AV26-1035, CISA KEV. Reported by BleepingComputer.