Ivanti Connect Secure Exploitation (CVE-2026-111357 and Chained CVEs)

If your company uses Ivanti Connect Secure (a VPN appliance), you need to do three things today: check your version, update to the latest release, and look for signs of compromise before you update. CISA lists CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 as exploited vulnerabilities, and the three can be chained. CISA also warns that Ivanti's Integrity Checker Tool may not detect exploitation because the attacker's commands run in memory. Patching alone does nothing for a device that was already breached.

This article is based on public information from CISA, the Canadian Centre for Cyber Security, Volexity and NVD as of October 31, 2026. Ivanti's own advisory page did not render when we checked, so versions below are taken from those public bodies. Where something could not be confirmed, we say it is not stated officially.

CVE-2026-104935 came first. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026. NVD describes an authentication bypass by spoofing that lets a remote, unauthenticated attacker execute arbitrary commands. Its CVSS 3.1 score is 8.6.

On October 30, CISA added two more flaws in the same product. CISA describes CVE-2026-111357 as letting a local authenticated attacker escalate privileges. NVD says the dsinvoked broker mishandles trust in DSCache configuration data, leading to privilege escalation to root, and notes exploitation in the wild in October 2026. Its CVSS 3.1 score is 7.0. CISA describes CVE-2026-118527 as letting a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. As of October 31, CVE-2026-118527 was not yet in NVD.

CISA says the three can be chained: the entries for CVE-2026-111357 and CVE-2026-118527 each name the other two. In short, an attacker can get in without logging in, place a file, and end up with root.

Volexity reported on October 13 that the actor it tracks as UTA0576 exploited these flaws starting October 3, 2026. A compromised appliance it examined was fully patched at the time, running version 22.8R2.4. Note that the disclosure date and the start of exploitation are different: attacks began before October 13.

CISA also says the actors are stealing credentials and exfiltrating data. A VPN appliance is the entrance to your internal network, so losing control of it can let an attacker move to other systems.

CISA lists versions as "this version and prior"; the Canadian Cyber Centre lists "prior to this version". The wording differs, but the conclusion is the same: update each line to its latest release, which satisfies both.

The differences can cause mistakes. Singapore's CSA alert lists 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, one release older than CISA's list in places. In practice, do not ask which wording your version matches; ask whether you are on the latest published release of your line. We could not confirm the exact latest build numbers because Ivanti's advisory was not readable, so check it directly.

NVD says CVE-2026-104935 does not impact 22.7R2.14 or prior. That is not an official statement that 22.7 is unaffected by the whole chain, and it may need updating for support reasons anyway. Check Ivanti's support information.

First, find out whether you run Ivanti Connect Secure (the SSL-VPN appliance descended from Pulse Connect Secure). If you have no IT staff, the contractor who built or maintains the VPN is the best lead. These steps usually work fastest.

1. Open the VPN login page and look for "Ivanti", "Connect Secure" or "Pulse" in the page or URL
2. Search maintenance contracts, design documents and the asset register for the product name
3. Ask someone with admin access, or your contractor, for the current version
4. Note whether the appliance is on-premises, a cloud or virtual machine, or hosted by a vendor (recovery steps differ)
5. Make sure the version you check is the appliance at the entrance, not the VPN client on user PCs

Whether Ivanti Policy Secure or other Ivanti products are affected by these three CVEs could not be confirmed from official sources, so this article covers Ivanti Connect Secure only.

The key point is to preserve evidence before you update. If logs are lost to an update or reboot, you can no longer tell whether you were breached.

1. Check and record the appliance version (a screenshot is fine)
2. Before updating, preserve logs and configuration, and memory or network records if possible. Ask the contractor how
3. Update to the latest release of the 25.1 or 22.8 line, after preparing for the compromise check
4. Look for suspicious admin logins and unexpected configuration changes before and after the update
5. Carry out the compromise checks below
6. If there is any suspicion, move to the recovery steps. Even without suspicion, consider changing administrator passwords
7. Contact your contractor today and use the question list below
8. If you run 22.8, plan for its end of support on January 31, 2027

A VPN update briefly cuts users off, so it is tempting to postpone. CISA's due dates for the three flaws are October 16, November 2 and November 13 (for US federal agencies), and companies elsewhere should treat the urgency similarly. Announce a short outage internally and do it.

CISA says the Integrity Checker Tool may not detect exploitation because the attacker's commands execute in memory. A clean result does not prove you were not breached. CISA says network and memory forensics are needed.

Even without in-house specialists, you can ask your contractor or a specialist firm to look for the following indicators, taken from Volexity's analysis.

These are examples Volexity saw; not every attack will show the same traces, and not finding them does not mean you are safe. Preserve logs before updating and keep them ready to hand to a specialist.

Volexity reported that, after compromise, the attacker used a compromised service account to send LDAP queries for LAPS passwords and BitLocker recovery information, and exfiltrated the results. LAPS manages local administrator passwords per PC, and BitLocker recovery information is the key to recover an encrypted disk. Losing either affects many PCs.

- List the service account(s) the VPN appliance uses to query AD
- Check whether their permissions are broader than needed
- Check domain controller logs for reads of LAPS passwords or BitLocker recovery information by those accounts
- If suspicious queries appear, consider rotating local administrator passwords and re-issuing BitLocker recovery keys on the affected PCs
- These are points to inform judgment; decide concrete steps with a specialist for your environment

If you find traces, or cannot rule compromise out, follow CISA's steps. The point is not to stop at patching but to return the appliance to a clean state.

1. Back up the configuration
2. Factory reset the appliance and upgrade to the latest version. For cloud or virtual appliances, rebuild and upgrade
3. Restore the configuration
4. Reset passwords for all accounts (domain, administrator and local)
5. Revoke and reissue certificates stored on the appliance
6. Reset stored API keys and license server credentials

Before step 3, it is wise to check that the backed-up configuration contains no changes planted by the attacker; CISA's text does not detail this, so ask a specialist. Steps 4 to 6 assume credentials may have been stolen. Ask VPN users to change their passwords as well.

Many companies outsource VPN operations. Use these questions as they are, and follow up on vague answers.

1. What version is our Ivanti Connect Secure on, and as of when?
2. When will you update to the latest 25.1 or 22.8 release, and will you preserve logs and memory first?
3. Beyond the Integrity Checker Tool, will network and memory forensics be done, and by whom?
4. Have you checked web logs for suspicious welcome.cgi requests and X-DSCGI-PATH mismatches, and from what date (at least before October 3, 2026)?
5. Have you reviewed the AD service account permissions and any reads of LAPS and BitLocker information?
6. If compromise is suspected, what do the factory reset and the password, certificate and API key re-issuance cost, and how long do they take?
7. If we are on 22.8, what is the plan after support ends on January 31, 2027?
8. How will you notify partners and remote workers who use our VPN?

CISA states the end of support for Ivanti Connect Secure 22.8 is January 31, 2027. If you run 22.8, this update is not the end: within about three months you need to move to a newer line or replace the setup.

VPN appliances are exposed to the internet and are easy targets. In general terms there are three options, and the right one depends on user count, destinations, budget and operating capacity.

- Move to a newer line of the same product (25.1)
- Replace it with another vendor's VPN, or a firewall's built-in VPN
- Stop exposing an appliance and switch to per-user, per-device, per-application authentication (zero-trust style access)

Every option fails if updates are late or settings are wrong. Deciding who checks versions and applies updates, and how often, matters more than choosing a product.

Today's roundup is the October 31 vulnerability digest. On entry-point design see zero trust security basics and UTM and firewall costs; for what to do when compromise is suspected see ransomware emergency response and data breach response.

- CISA KEV catalog (known_exploited_vulnerabilities.json): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- CISA alert, revised Oct 30: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerabilities-ivanti-connect-secure
- Canadian Centre for Cyber Security AV26-1035: https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035
- Singapore CSA AL-2026-147: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-147/
- Volexity: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- NVD (CVE-2026-104935, CVE-2026-111357): https://nvd.nist.gov/
- Ivanti security advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935