# Ivanti Connect Secure: three chained zero-days are exploited. Patching isn't enough — assume compromise

> Attackers chained an authentication bypass with two newer Ivanti Connect Secure flaws to get root on VPN appliances, and CISA's first federal deadline has already passed. Here's which builds fix it and what to check if your box was exposed.

Published Nov 2, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/ivanti-connect-secure-zero-day-chain-cve-2026-111357-what-to-do

Attackers are chaining three vulnerabilities in **Ivanti Connect Secure**, the widely used enterprise VPN appliance, to go from an unauthenticated web request to root on the box. Ivanti shipped fixes for the two newest flaws, **CVE-2026-111357** and **CVE-2026-118527**, on October 29, and CISA added both to its Known Exploited Vulnerabilities catalog on October 30, according to Canada's Cyber Centre and SecurityOnline. Ivanti says exploitation has affected "a limited number of customers," per SecurityOnline.

Why it matters: a VPN gateway sits at the edge of the network and holds the keys to it. In this campaign, according to Tech Insider's summary of Volexity's research, the attackers went on to steal LDAP credentials and query for LAPS passwords and BitLocker recovery keys, then cleaned up logs. US federal agencies had until **November 2** to deal with CVE-2026-111357 — a deadline TheHackerWire and Tech Insider both list — so that clock has already run out.

## The three bugs

| CVE | What it does | Severity | Added to CISA KEV |
|---|---|---|---|
| CVE-2026-104935 | Authentication bypass letting an unauthenticated attacker run commands | CVSS 8.6 (SecurityOnline) | October 13 |
| CVE-2026-111357 | Missing authentication on a critical function; local privilege escalation to root | 8.8 per Ivanti; 7.0 in the CVE record | October 30 |
| CVE-2026-118527 | Predictable file names let an authenticated attacker place files at known paths | CVSS 4.3 | October 30 |

Individually, two of these look moderate. Chained, they give an outsider root. According to Tech Insider's account of Volexity's findings, the first step abuses the login page to reach protected scripts, a race condition runs an uploaded script before it is deleted, and the attacker then abuses a root-level service and its configuration cache to execute commands as root. Commands rode inside normal HTTPS traffic, and no web shell was found. Volexity tracks the actor as **UTA0576**.

## Which builds are affected and fixed

Canada's Cyber Centre lists Connect Secure as affected **before 25.1.1.3, before 25.1.3.1, and before 22.8R2.6**. SecurityOnline says the 22.7.x line and earlier are not affected by the October 29 pair.

| Branch | Upgrade to |
|---|---|
| 25.1.1.x | 25.1.1.3 or later |
| 25.1.2.x / 25.1.3.x | 25.1.3.1 or later |
| 22.8 | 22.8R2.6 (Ivanti reportedly prefers moving to 25.1.1.3 or later) |

Write-ups disagree on some fixed builds, and SecurityOnline's own summary contradicts its body text. Confirm your exact target build against Ivanti's advisory on its support hub before upgrading.

## What to do

1. **Upgrade now** to a fixed build for your branch.
2. **Assume compromise if the appliance was internet-facing on a vulnerable build.** Tech Insider reports that Ivanti's Integrity Checker Tool will not reliably detect this activity, so a clean check is not an all-clear.
3. **Preserve evidence before you reboot or reset.** Capture memory and logs first; the attackers selectively deleted lines from the debug and audit logs.
4. **Hunt for indicators** published by Volexity and summarized by Tech Insider, including:
   - requests to `/dana-na/auth/url_default/welcome.cgi` carrying an `X-DSCGI-PATH` header;
   - unexpected files in `/tmp/`, `/data/.icscap/` and `/home/runtime/tmp/` (for example files named `ics-root-run-inband-*`);
   - traffic to 108.165.147[.]64.
5. **Rotate credentials** reachable from the appliance, starting with the LDAP service account, LAPS passwords and BitLocker recovery keys.
6. **Bring in incident response** if you lack in-house forensics for appliances.

## Who should care

Any organization running Ivanti Connect Secure, especially those that only applied the October 13 fix for CVE-2026-104935. That patch closed the front door, but appliances compromised before it — or before October 29 — may still be under an attacker's control. The remaining federal KEV deadline, for CVE-2026-118527, is **November 13**, per Tech Insider.


## Sources

1. [Canadian Centre for Cyber Security — Ivanti security advisory (AV26-1035), update 2](https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035)
2. [SecurityOnline — Ivanti Connect Secure vulnerability exploited](https://securityonline.info/ivanti-connect-secure-vulnerability-exploited/)
3. [Tech Insider — Ivanti Connect Secure: 2 new zero-day CVEs, KEV deadline Nov 13](https://tech-insider.org/ivanti-connect-secure-cve-2026-111357-118527-kev-deadline-nov-13-2026/)
4. [TheHackerWire — CVE-2026-111357](https://www.thehackerwire.com/vulnerability/CVE-2026-111357/)