Ivanti Connect Secure: three chained zero-days are exploited. Patching isn't enough — assume compromise

Attackers are chaining three vulnerabilities in Ivanti Connect Secure, the widely used enterprise VPN appliance, to go from an unauthenticated web request to root on the box. Ivanti shipped fixes for the two newest flaws, CVE-2026-111357 and CVE-2026-118527, on October 29, and CISA added both to its Known Exploited Vulnerabilities catalog on October 30, according to Canada's Cyber Centre and SecurityOnline. Ivanti says exploitation has affected "a limited number of customers," per SecurityOnline.

Why it matters: a VPN gateway sits at the edge of the network and holds the keys to it. In this campaign, according to Tech Insider's summary of Volexity's research, the attackers went on to steal LDAP credentials and query for LAPS passwords and BitLocker recovery keys, then cleaned up logs. US federal agencies had until November 2 to deal with CVE-2026-111357 — a deadline TheHackerWire and Tech Insider both list — so that clock has already run out.

The three bugs

Individually, two of these look moderate. Chained, they give an outsider root. According to Tech Insider's account of Volexity's findings, the first step abuses the login page to reach protected scripts, a race condition runs an uploaded script before it is deleted, and the attacker then abuses a root-level service and its configuration cache to execute commands as root. Commands rode inside normal HTTPS traffic, and no web shell was found. Volexity tracks the actor as UTA0576.

Which builds are affected and fixed

Canada's Cyber Centre lists Connect Secure as affected before 25.1.1.3, before 25.1.3.1, and before 22.8R2.6. SecurityOnline says the 22.7.x line and earlier are not affected by the October 29 pair.

Write-ups disagree on some fixed builds, and SecurityOnline's own summary contradicts its body text. Confirm your exact target build against Ivanti's advisory on its support hub before upgrading.

What to do

1. Upgrade now to a fixed build for your branch.
2. Assume compromise if the appliance was internet-facing on a vulnerable build. Tech Insider reports that Ivanti's Integrity Checker Tool will not reliably detect this activity, so a clean check is not an all-clear.
3. Preserve evidence before you reboot or reset. Capture memory and logs first; the attackers selectively deleted lines from the debug and audit logs.
4. Hunt for indicators published by Volexity and summarized by Tech Insider, including:
   • requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header;
   • unexpected files in /tmp/, /data/.icscap/ and /home/runtime/tmp/ (for example files named ics-root-run-inband-*);
   • traffic to 108.165.147[.]64.
5. Rotate credentials reachable from the appliance, starting with the LDAP service account, LAPS passwords and BitLocker recovery keys.
6. Bring in incident response if you lack in-house forensics for appliances.

Who should care

Any organization running Ivanti Connect Secure, especially those that only applied the October 13 fix for CVE-2026-104935. That patch closed the front door, but appliances compromised before it — or before October 29 — may still be under an attacker's control. The remaining federal KEV deadline, for CVE-2026-118527, is November 13, per Tech Insider.