Ivanti Connect Secure: Two More Flaws Exploited in a Chain, Fixed in 25.1.1.3 and 22.8R2.6

Ivanti has patched two more Connect Secure VPN flaws that attackers chained with CVE-2026-104935, the authentication bypass disclosed on 13 October, to compromise "a limited number of customers". The fixed releases are 25.1.1.3 and 22.8R2.6, out on 29 October. CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 30 October and gave US federal agencies until 2 November to fix CVE-2026-111357.

The two flaws

CVE-2026-111357 is what Ivanti calls "missing authentication for a critical function", which lets an attacker who already has a foothold on the appliance raise their privileges. Ivanti rates it CVSS 8.8.

The second, CVE-2026-118527, is rated 4.3: predictable filenames let a remote, logged-in attacker upload files with attacker-controlled content to a known location on disk. The attacks Ivanti knows of used all three, exploited "when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained"; CVE-2026-104935 needs no login.

Ivanti lists 25.1.1.2 and earlier, and 22.8R2.5 and earlier, as affected. The fix for CVE-2026-104935 was already in testing when the other two turned up, and Ivanti shipped it first, saying it decided to "not delay getting a fix to customers".

What the attackers did

Volexity, which found the attacks, says the actor it tracks as UTA0576 began exploiting the chain on 3 October, against an appliance that was fully patched at the time, on 22.8R2.4. Once inside, the attacker pulled domain credentials stored on the VPN and ran a tool to search Active Directory for LAPS local administrator passwords and BitLocker recovery keys. Volexity says the payload also deleted recent entries from the appliance's debug and audit logs.

Volexity assesses "with low confidence" that the group is criminal rather than espionage-driven. It found no web shell or first-stage malware, so the attacker had to exploit the device again each time.

The integrity checker can miss it

The chain patches library code in memory and puts configuration data back afterwards, so Ivanti's Integrity Checker Tool "does not detect any modifications", according to Volexity. CISA gave the same warning on 13 October, that the tool "may not detect evidence of exploitation".

What to do

• Connect Secure 25.1.x: update to 25.1.1.3.
• Connect Secure 22.8: update to 22.8R2.6. Ivanti puts the end of life for the 22.8 line at 31 January 2027.
• Appliances exposed since early October: Volexity recommends watching for large numbers of requests to /dana-na/auth/url_default/welcome.cgi and checking /tmp/ for signs of post-exploitation activity. On any device you suspect, it says to run network and memory forensics. CISA's advice for appliances that may have been hit is a factory reset and new passwords, certificates and API keys.

The rest of October's exploited flaws, with fixed versions, are in the CISA KEV roundup for October 2026.