Menu
Breach value calculatorCalculator

Ivanti Connect Secure CVE-2026-111357: Patch, Then Hunt for Intruders

Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527 are exploited. Fixed versions, why a clean Integrity Checker scan isn't proof, what to do.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Published 13 min read

Volexity reports attackers exploiting Ivanti Connect Secure VPN appliances from 3 October 2026. Ivanti says the exploitation it knows of chained three flaws, CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527, against "a limited number of customers". Releases 25.1.1.3 and 22.8R2.6 fix all three. Patch, then check for compromise: Volexity warns the Integrity Checker "may not be able to identify device compromise".

Sources checked 1 November 2026.

Ivanti Connect Secure is a remote access VPN gateway. Staff log in through it from outside to reach internal systems, so it sits on the internet and holds credentials for your directory.

This post answers three questions: what the flaws are, whether your appliance is affected, and what to do this week. For why VPN gateways and firewalls draw so much attacker attention, see why edge devices get exploited. For whether to keep a VPN at all, see ZTNA vs VPN.

What are Ivanti Connect Secure CVE-2026-111357, CVE-2026-118527 and CVE-2026-104935?

They are three separate flaws that do different jobs in one attack. One gets an outsider past the login, one lets them place files on the appliance, and one turns limited access into root, the account with full control of the device.

CVE What it is Needs a login on its own? Severity Added to CISA KEV
CVE-2026-104935 Authentication bypass by spoofing that lets an outsider run commands (CWE-290) No: "remote unauthenticated" (CISA) CVSS 8.6 High (Ivanti) 13 October 2026, due 16 October 2026
CVE-2026-111357 Missing authentication for a critical function, used to escalate privileges (CWE-306, CWE-862, CWE-345 per Ivanti and CISA) Yes: "local authenticated" (CISA) CVSS 8.8 High (Ivanti); CVSS v3.1 7.0 High (CVE record, filed by MITRE) 30 October 2026, due 2 November 2026
CVE-2026-118527 Predictable filenames that let an attacker upload files with their own content to a known location on disk (CWE-340) Yes: "remote authenticated" (CISA) CVSS 4.3 Medium (Ivanti) 30 October 2026, due 13 November 2026

Sources: Ivanti's security advisory, Ivanti's CVE record for CVE-2026-104935, MITRE's CVE record for CVE-2026-111357 and the CISA KEV feed, version 2026.10.30.

CVSS is a 0-10 severity score, and a CWE number names the type of weakness. CISA's Known Exploited Vulnerabilities (KEV) catalogue lists flaws it has evidence attackers are using.

Two of the three need a login when you look at them one at a time. That is the point of the chain.

The authentication bypass in CVE-2026-104935 removes the login, so the whole sequence works for someone who has never had an account. Volexity's title for its write-up says as much: "a series of unauthenticated events".

A gap in the public record. CVE-2026-118527 has no published CVE record yet. On 1 November 2026 the CVE Services API returned "404 Not Found" for it, and the NVD page linked from the KEV entry displayed no record.

What this post says about it comes from Ivanti's advisory and CISA's KEV catalogue. CISA's entry for CVE-2026-111357 says it "can be chained with CVE-2026-104935 and CVE-2026-118527".

Two scores and two labels for one flaw. Ivanti rates CVE-2026-111357 at CVSS 8.8 and, like CISA, classes it as missing authentication for a critical function. The CVE record, filed by MITRE, rates it 7.0 and classes it as CWE-829, "Inclusion of Functionality from Untrusted Control Sphere".

Both describe a privileged component accepting input it should not trust. Where they differ, the vendor's advisory is the one your patch plan should follow.

How did attackers use the Ivanti Connect Secure chain?

Volexity, a security firm, found the activity at what it calls "a Network Security Monitoring customer". It began investigating on 5 October 2026.

It tracks the attacker as UTA0576, "a previously unknown threat actor". It assesses "with low confidence" that the group is criminally rather than espionage motivated, and with medium confidence that it uses large language models to build exploits and work after the break-in.

The appliance it investigated was, in Volexity's words, "fully patched (at the time, version 22.8R2.4)". These were zero-days: flaws with no fix available when attackers first used them.

Once in, the attacker went after the keys to the wider network, not the VPN itself. Volexity reports that the attacker:

  • Took stored credentials from the appliance, including the service account it uses to query the company directory (LDAP).
  • Searched the directory for LAPS passwords, BitLocker recovery keys and stored password values. LAPS, Microsoft's Local Administrator Password Solution, keeps a unique local admin password for each Windows computer in the directory. A BitLocker recovery key unlocks an encrypted Windows drive.
  • Captured network traffic on the appliance to harvest logins passing through it.
  • Tried passwords against many Active Directory accounts (password spraying) and ran a tool that attacks Kerberos, the system Windows networks use for logins.
  • Edited logs to remove entries, deleted its own tools, and put changed memory and configuration back the way it found them.

Volexity "did not identify first-stage malware or web shells". There was no implant left behind to find, which matters for the next section.

When did each step happen?

Date (2026) Event Source
3 October UTA0576 starts exploiting the flaws, repeatedly Volexity
5 October Volexity begins its investigation Volexity
13 October Ivanti publishes its advisory and patches for CVE-2026-104935; CISA adds it to KEV; Volexity publishes Ivanti advisory, Volexity, CISA KEV
15 October CVE record for CVE-2026-111357 published CVE record
29 October Ivanti releases 25.1.1.3 and 22.8R2.6, fixing CVE-2026-111357 and CVE-2026-118527 Ivanti advisory, Volexity update
30 October CISA adds CVE-2026-111357 and CVE-2026-118527 to KEV CISA alert

Is your Ivanti Connect Secure appliance affected?

Start with three checks.

  1. Do you run Ivanti Connect Secure? Ivanti's advisory, the CVE records and the KEV entries name Connect Secure. If you run other Ivanti remote access products, ask Ivanti; the sources cited here don't name them.
  2. Which release does it run? Per Ivanti's advisory, CVE-2026-104935 affects 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, and "does not impact" 22.7R2.14 or earlier. CVE-2026-111357 and CVE-2026-118527 affect 25.1.1.2 and earlier, and 22.8R2.5 and earlier.
  3. Was it reachable from the internet at any point since 3 October 2026 before you installed a fixed release? If yes, treat it as possibly compromised until you have checked.

Ivanti's advisory lists 25.1.1.3 and 22.8R2.6 as the fixed releases for CVE-2026-111357 and CVE-2026-118527, and 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5 for CVE-2026-104935. By release line, Ivanti's guidance is:

You run Ivanti's target Note
22.7 Not affected: Ivanti says 22.7.X and earlier don't contain the flaws End of life 31 January 2027
22.8 25.1.1.3 or later; 22.8R2.6 if you can't move to 25.1 yet End of life 31 January 2027
25.1.1.1 (ISA6000, ISA8000) 25.1.1.3 Fixes all three
25.1.3.0 or later (ISA4500, ISA6500, ISA8500) Already there: Ivanti says these don't contain the flaws 25.1.3.0 shipped in July 2026

Source: Ivanti's security advisory, last modified 29 October 2026. The advisory's solution section doesn't name a separate path for 25.1.2; Ivanti lists 25.1.3.0 and 25.1.3.1 as resolving CVE-2026-104935 for that line.

What should Ivanti Connect Secure owners do this week?

Patch first, then check, then clean up.

  1. Upgrade to a fixed release: 25.1.1.3 or later, or 22.8R2.6 if you can't move to 25.1 yet. Internet-facing appliances first. Plan 22.x appliances off before their end of life on 31 January 2027.
  2. Run Ivanti's Integrity Checker Tool (ICT), but don't treat a clean result as an all-clear. In the case it investigated in October 2026, Volexity found that "the tool does not detect any modifications". The attacker changed code only in memory and restored the configuration data afterwards, so a check of files on disk had nothing to find. Ivanti itself says there are "limited indicators of compromise available" and advises running the ICT regularly alongside Volexity's indicators.
  3. Hunt for signs of compromise, starting with logs kept off the appliance. The attacker removed entries from logs on the device itself. Copies already sent to a SIEM (a central log and alerting system) or log server are the ones to trust. Compare them with what the appliance still holds; missing entries are a finding, not noise.
  4. If you find signs of compromise, reset what the appliance held or saw. That means the directory service account it uses, local admin passwords managed by LAPS, BitLocker recovery keys, Kerberos service account passwords, and the passwords of users who logged in through it. Follow Ivanti's recovery steps for suspected exploitation. An exploited gateway is an identity incident; the ZTNA vs VPN post walks through the reset sequence CISA required after the Ivanti compromises of January 2024.
  5. Bring in incident response help before you rebuild. Volexity recommends memory and network forensics on suspected devices, because the on-disk check failed. Ask your responder whether to capture memory before a restart or upgrade.
  6. Keep a written record of each appliance, its release before and after, the ICT result, what you checked and who did it.

Emergency patching as a repeatable process has its own post: time to exploit and emergency patching.

What are CISA's deadlines for these Ivanti flaws?

CISA's 30 October alert added both flaws to the Known Exploited Vulnerabilities (KEV) catalogue. The KEV feed gives CVE-2026-111357 a due date of 2 November 2026, three days after listing. CVE-2026-118527 has until 13 November 2026, fourteen days.

Those dates bind US federal civilian agencies under Binding Operational Directive (BOD) 26-04; CISA's alert says the directive "applies only to FCEB agencies". For everyone else they are a measure of urgency.

The required action in both entries begins "Apply mitigations in accordance with vendor instructions" and points to the directive's forensic triage guidance. CISA's alert says BOD 26-04 "further establishes basic expectations for when agencies must check whether threat actors" compromised a system before it was patched. That is the same message as Volexity's: patching alone does not close the case.

Known ransomware campaign use is "Unknown" for all three entries. For how KEV fits alongside CVSS and EPSS scores, see CVE, CVSS, EPSS and KEV explained.

Going deeper: for security and IT teams

Identifiers and scoring. CVE-2026-104935: Ivanti is the CNA, CWE-290, CVSS v3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, published 13 October 2026. CVE-2026-111357: MITRE is the CNA; the record gives CWE-829 and CVSS v3.1 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, published 15 October 2026, last updated 31 October 2026. Ivanti's advisory scores the same flaw 8.8 with CWE-306, CWE-862 and CWE-345, the CWEs CISA's KEV entry also uses. CVE-2026-118527: Ivanti gives CVSS 4.3 and CWE-340; no CVE record as of 1 November 2026.

Note the 7.0: AV:L and PR:L score CVE-2026-111357 as a local flaw needing an existing foothold. That is accurate in isolation and misleading in this chain, where CVE-2026-104935 supplies the foothold from the internet. Score the chain, not the link.

Mechanism, as Volexity describes it. The attacker sends a request to the public /dana-na/auth/url_default/welcome.cgi handler that names a different script in its headers, reaching handlers that should need a login. A file write weakness in wu.cgi lets attacker-supplied content land on disk, which gives code execution as the cgi-server user. The CVE record describes the privilege escalation as the dsinvoked broker trusting DSCache configuration data, which ends in commands running as root.

The attacker "passed commands and results through the exploit chain's HTTPS requests" rather than a separate command-and-control channel, so there is no beaconing to catch. Volexity tracks the bypass and the command execution as CVE-2026-104935. Its post doesn't name CVE-2026-118527, and none of the sources cited here maps that ID to a specific step, so don't assume which one it is.

Threat model. The attacker needs network reach to the VPN portal and nothing else. They get root on the appliance, the credentials stored in its configuration, a position to capture traffic from everyone authenticating through it, and, via the LDAP service account, read access to sensitive directory attributes.

Detection, from Volexity's indicators. - Network or proxy logs (if anything in front of the appliance records HTTP headers): large volumes of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that names another script. Volexity's example is X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi. A request to one script whose header names a different one is the pattern to alert on. - Appliance files: uploads written to /home/runtime/tmp/ under an MD5 hash of the filename; ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt or spray_hits.json in /tmp/; a process named dsstatmond running from /data/.icscap/, which Volexity says is a renamed tcpdump; packet capture files at /data/.icscap/cap*. - Log integrity: gaps in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log compared with your off-box copies. - Infrastructure: 108.165.147[.]64, which Volexity says ran an OpenVPN server from 30 September to 7 October 2026. Volexity publishes its full indicator files alongside the post. - Directory side (an inference from the activity Volexity describes, not a Volexity indicator): queries from the appliance's service account for LAPS or BitLocker recovery attributes, Kerberos service ticket requests sourced from the appliance, and one source failing logins across many accounts.

In practice: Connect Secure keeps reappearing in KEV. The 2026.10.30 KEV feed has three related Connect Secure entries in 17 days: CVE-2026-104935 added on 13 October 2026 with a three-day deadline, then CVE-2026-111357 (three days) and CVE-2026-118527 (fourteen days) on 30 October 2026. CISA's entry for CVE-2026-111357 says the three can be chained, and Ivanti says the exploitation it knows of chained them.

It is not the first time. On 19 January 2024 CISA issued Emergency Directive 24-01 for Ivanti Connect Secure and Policy Secure, covering CVE-2023-46805 and CVE-2024-21887. The lesson repeats: a fully patched appliance was still breached in October 2026, so plan for compromise, not just for patch speed.

Questions for your MSP or Ivanti. - Is each appliance on 25.1.1.3, 22.8R2.6, or 25.1.3.0 or later today? - Were any appliances internet-facing between 3 October 2026 and the day they were upgraded, and what did ICT and any external forensics find? - What is the plan for 22.7 and 22.8 appliances before their end of life on 31 January 2027? - Do appliance logs stream off the device in real time, and for how long are they kept? - Which accounts and secrets does the appliance store, and when were they last rotated? - Do you capture HTTP request headers in front of the appliance?

Key takeaways

  • Volexity observed exploitation of CVE-2026-104935 and CVE-2026-111357 from 3 October 2026. Ivanti says the exploitation it knows of chained them with CVE-2026-118527, and CISA says the three can be chained.
  • CISA listed CVE-2026-111357 and CVE-2026-118527 in KEV on 30 October 2026, with due dates of 2 and 13 November 2026 for US federal agencies.
  • Ivanti's fixed releases for all three are 25.1.1.3 and 22.8R2.6; 25.1.3.0 or later doesn't contain the flaws. Releases 22.7 and 22.8 reach end of life on 31 January 2027.
  • A clean Integrity Checker result is not proof: in Volexity's October 2026 case it detected no changes from in-memory edits, and logs on the device were edited.
  • If you find signs of compromise, treat it as an identity incident and rotate everything the appliance stored or saw.

Sources

Spotted a mistake? Report a correction.