Ivanti Connect Secure Exploit Chain Reaches CISA KEV: Patch and Check for Compromise

If your business runs its remote access through an Ivanti Connect Secure VPN, this is a same-week job. On 30 October 2026 CISA added two more Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog, completing a picture that the security firm Volexity began publishing on 13 October. This guide explains what is known, which versions to move to and how to check whether the appliance or the accounts behind it were touched. It uses only CISA's catalog, Volexity's research and a news report, and it leaves out technical detail that would help an attacker.

A VPN appliance sits at the edge of the network, which is why its credentials and logs matter. Photo: Dsimic, CC BY-SA 4.0, via Wikimedia Commons

The short answer

• What changed: CISA added CVE-2026-111357 and CVE-2026-118527 to KEV on 30 October 2026, after exploitation was observed.
• How they fit together: CISA's entries say each can be chained with CVE-2026-104935, the authentication bypass and code execution flaw added to KEV on 13 October. Volexity describes the chain as giving unauthenticated, root-level code execution.
• Fix: The Hacker News reports 25.1.1.3 and 22.8R2.6 as the fixed versions for the two newly added flaws.
• Do not stop at patching: Volexity says the attacker went after credentials and Active Directory secrets, so review what the appliance could reach.

What CISA and Volexity say

CISA's catalog describes CVE-2026-111357 as a missing authentication for a critical function flaw that could let a local authenticated attacker escalate privileges, and CVE-2026-118527 as a predictable identifier flaw that could let a remote authenticated attacker upload files with attacker-controlled content to a known location. The Hacker News gives CVSS scores of 8.8 and 4.3 for the two. CISA's required action is to apply mitigations per the vendor instructions, and its due dates are 2 November 2026 for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527.

Volexity's report explains why a modest-looking score can still matter. It says that in the first week of October 2026 it found an unknown actor, which it tracks as UTA0576, compromising a fully patched appliance running version 22.8R2.4. The exploit chain combined an authentication bypass, a remote code execution flaw and a privilege escalation flaw. Volexity says exploitation began on 3 October 2026 and that the first two parts are tracked as CVE-2026-104935. A flaw that needs a login on its own can become dangerous when it follows a bug that removes the login.

Volexity added an update on 29 October that Ivanti had published a patch for the privilege escalation flaw, CVE-2026-111357. According to The Hacker News, Ivanti said it had a fix for CVE-2026-104935 already in quality assurance when the escalation flaw was found and chose to ship it without waiting, which is why the later fixes arrived separately.

What the attacker did after getting in

This part is the reason to look beyond the patch. Volexity reports that after exploitation the actor:

• Extracted credentials stored on the appliance, including domain credentials used for directory lookups.
• Collected limited Active Directory metadata.
• Searched for local administrator passwords managed by LAPS and for BitLocker recovery keys.
• Tried password spraying and inspected authentication logs to find valid usernames.
• Deleted evidence from some debug and audit logs.

Volexity also says it did not see a web shell or backdoor on the appliance. Commands and results travelled through the exploit's own web requests. It assesses with high confidence that the activity signalled preparation for lateral movement and a broader compromise, and with medium confidence that the actor used large language models in its work. Because the investigation was disrupted early, Volexity says the actor's final goals are unknown.

For a small or mid-size business the practical meaning is simple. A VPN appliance holds keys to the rest of your network. If it was reached before you patched, the question is not only "is the box clean" but "which accounts and secrets did it hold".

What to do now

1. Find your appliances and versions. List every Ivanti Connect Secure instance, including ones run by a vendor or a branch office.
2. Patch to the fixed release. The Hacker News reports 25.1.1.3 and 22.8R2.6 for the two newly added flaws. Confirm in Ivanti's advisory which release is right for your line. Volexity also lists 25.1.1 and prior, 25.1.2 and 22.8R2.4 as versions that should be upgraded to the newest release.
3. Assume exposure if the patch came late. If your appliance was reachable from the internet before the fixes, treat it as potentially touched and move to the checks below.
4. Review the appliance for signs of compromise. Volexity recommends monitoring for unusual request patterns to the login page and checking the temporary directory for post-exploitation evidence. It warns that Ivanti's Integrity Checker may not detect a compromise, so it recommends network and memory forensics if you suspect one. Involve your provider or an incident-response firm for this step.
5. Rotate secrets the appliance held. That means directory service accounts, any shared secrets and the passwords of accounts that signed in through the VPN. Our guide to rotating secrets after a breach gives a sensible order.
6. Check administrator passwords and recovery keys. If LAPS or BitLocker recovery keys are stored in your directory, review who and what accessed them recently, and rotate where there is doubt.
7. Review sign-in logs for odd locations, failed bursts and new devices over the period since early October.

For similar edge-device incidents, see our posts on the Cisco ASA and FTD VPN flaw and the GitLab flaw added to KEV. If you would like help auditing remote access, our custom software development service and website development service include security reviews and patch routines.

Checklist for this week

• List every Ivanti Connect Secure appliance and its current version.
• Upgrade to the fixed release for your version line, after reading Ivanti's advisory.
• Record when each appliance was patched and whether it faced the internet before that.
• Ask your provider or an incident-response firm to check any exposed appliance for compromise.
• Rotate directory service account passwords used by the appliance.
• Review LAPS and BitLocker recovery key access in your directory.
• Force password resets for accounts with unusual sign-in activity.
• Keep the appliance's logs and a copy of its configuration before changing anything.
• Add multi-factor authentication to remote access if it is not already in place.
• Schedule a monthly review of edge devices and their firmware versions.

Common mistakes to avoid

Patching and moving on. Volexity reports credential theft and log deletion, so a patch does not prove the device was clean.

Trusting the vendor integrity tool alone. Volexity warns it may not identify a compromise.

Ignoring the lower score. CVE-2026-118527 has a low CVSS score reported, but CISA lists it as exploited and chained.

Forgetting the accounts behind the box. Service accounts, local administrator passwords and recovery keys are what an attacker wants next.

Waiting for the federal deadline. CISA's dates are for agencies; most businesses should move sooner.

Key takeaways

• CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV on 30 October 2026, as parts of a chain that includes CVE-2026-104935.
• Reported fixed versions are 25.1.1.3 and 22.8R2.6 for the two newly added flaws.
• Volexity reports credential theft, directory reconnaissance and log deletion after exploitation.
• Patch, check for compromise and rotate the secrets the appliance held.
• Treat edge devices as a standing patch routine, not an occasional job.

Want a second pair of eyes on your remote access setup? See our custom software development service or talk to our team.

Sources

• CISA: Known Exploited Vulnerabilities Catalog
• Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (13 October 2026, updated 29 October)
• The Hacker News: Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (31 October 2026)

Last reviewed 31 October 2026. This article is general information, not a guarantee of protection. Versions and fixes can change, so confirm them in Ivanti's advisory before acting. We did not retrieve Ivanti's advisory page directly.