Anyone running a VPN gateway from Ivanti has more patching to do: on October 30, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two more vulnerabilities in Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-111357 allows privilege escalation to root, while CVE-2026-118527 lets an attacker place files with attacker-controlled content at a known location on the device. Combined with CVE-2026-104935, disclosed in mid-October, they form a chain that let attackers run commands as root without logging in.
For U.S. federal agencies, the deadline for CVE-2026-111357 expires on Monday, November 2, 2026. For everyone else, the key point is this: having updated after Ivanti’s first October patch does not automatically mean you are protected.
Ivanti Connect Secure: the three flaws in the chain
The chain consists of three CVE IDs that Ivanti covers together in its security advisory for CVE-2026-104935. According to CISA’s alert, updated on October 30, threat actors are exploiting the flaws to steal credentials and exfiltrate data.
- CVE-2026-104935 – authentication bypass by spoofing. A remote, unauthenticated attacker can execute arbitrary commands. In the KEV catalog since October 13.
- CVE-2026-111357 – missing authentication for a critical function. A local authenticated attacker with low privileges can escalate privileges. Belgium’s Centre for Cybersecurity (CCB) rates it CVSS 8.8, while NHS England lists 8.6. Added to KEV on October 30, due November 2, with forensic triage required under CISA’s BOD 26-04.
- CVE-2026-118527 – predictable identifiers. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. CVSS 4.3. Added to KEV on October 30, due November 13.
The individual scores look moderate at first glance, because two of the three flaws require authentication or local access. That is exactly what the first flaw provides. According to the CCB, Ivanti has confirmed that the two new vulnerabilities were chained with CVE-2026-104935 to achieve pre-authentication remote code execution and then root privileges. NHS England says Ivanti observed exploitation affecting a limited number of customers at the time of disclosure.
Which versions are affected
CISA lists Ivanti Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. The Canadian Centre for Cyber Security names 25.1.1.3, 25.1.3.1 and 22.8R2.6 as the fixed releases. Note 22.8R2.5 in particular: that version fixed CVE-2026-104935 but is now on the affected list itself, because the privilege escalation was only fixed later. According to Volexity, Ivanti published the patch for CVE-2026-111357 on October 29.
There is also a lifecycle issue: the 22.8 branch reaches end of life on January 31, 2027, according to CISA. For hardware and virtual appliances, CISA points to Ivanti’s upgrade and migration compatibility guide for the 25.x line. Anyone still on 22.8 should plan that migration regardless.
How the attack worked, according to Volexity
The chain was discovered by security firm Volexity. In its analysis from October 13, it describes how a previously unknown actor it tracks as UTA0576 compromised an appliance running 22.8R2.4 – fully patched at the time – starting on October 3, 2026. The investigation at a customer began on October 5.
The technical chain, according to Volexity, in three steps:
- Authentication bypass: Requests to the public script
/dana-na/auth/url_default/welcome.cgicarried anX-DSCGI-PATHheader pointing to a protected script. The URL decided whether a request was allowed; the header decided where it went. - Code execution: Via the
wu.cgiupload handler, a Perl script briefly landed on disk before being deleted as an invalid ZIP file. Parallel requests executed the script during that window – a race condition. - Root privileges: The privileged
dsinvokedservice trusted configuration data from the shared DSCache store. The attacker modified that entry and had a maintenance task run their own script as root. According to Volexity’s update, this privilege escalation is what is now tracked as CVE-2026-111357.
What happened next stands out. UTA0576 deployed neither a web shell nor a backdoor; instead, it re-ran the full chain for every command and received the output directly in the HTTPS response. It then removed entries from the Ivanti debug log and the Linux audit log, restored modified memory and deleted temporary files. Volexity says Ivanti’s Integrity Checker Tool does not detect this kind of compromise, because only in-memory content is altered and then restored.
The main target was credentials: LDAP credentials stored on the appliance, Active Directory metadata, LAPS administrator passwords and BitLocker recovery keys. On top of that came a custom Kerberos tool, password spraying and parsing of packet captures for plaintext credentials. Volexity assesses with low confidence that UTA0576 has criminal rather than espionage motives, and with medium confidence that the actor uses large language models for exploit development and post-exploitation. Researchers are seeing similar patterns more often, for example in the AI-assisted VAPOR PANDA campaign.
What operators should do now
CISA urges organizations to update affected appliances to the latest version immediately. Because a patch does not undo a compromise that has already happened, the response needs more than that:
- Check and update the version: Move to 25.1.1.3, 25.1.3.1 or 22.8R2.6 or later – even if 22.8R2.5 is already installed.
- Hunt for traces: Volexity recommends watching for large numbers of requests to
welcome.cgiwith anX-DSCGI-PATHheader, especially where the URL path and the header path do not match, and checking/tmp/for leftovers. Volexity publishes indicators on GitHub. - Forensics, not just integrity checks: If compromise is possible, CISA says network and memory forensics are needed. A clean Integrity Checker result does not rule out an intrusion.
- Recovery if compromise is suspected: Based on Ivanti’s recovery procedures, CISA describes four steps: back up the configuration, factory reset and upgrade (rebuild virtual instances), restore the configuration, then reset all passwords – domain, administrator and local accounts – revoke and reissue stored certificates, and reset API keys and license server credentials.
- Think about Active Directory: Because UTA0576 specifically queried LAPS passwords and BitLocker keys, those should be rotated as well if compromise is suspected, and the appliance’s service account should be reviewed.
Analysis
VPN gateways remain among the most attractive targets there are: they sit directly on the internet, are often tied into the directory service and are hard to monitor. The Ivanti case shows the problem in its most uncomfortable form. Those who patched quickly in October were protected against the initial entry point, but remained exposed to the privilege escalation until October 29. And anyone hit before patching may not even see it with the vendor’s own tool.
As with the recent actively exploited GitLab flaw CVE-2026-97229, CISA’s deadlines are formally binding only on U.S. federal agencies, but they are a useful benchmark for everyone else. For Ivanti Connect Secure, that means: patch by early next week at the latest, and do not rely on a clean integrity check for exposed devices.
