Ivanti Connect Secure · Exploitation confirmed

Ivanti Releases Patches for Connect Secure Zero-Days Exploited in Chain

Oct 30, 2026 · 1 min read

Attackers chained three Ivanti Connect Secure zero-days (CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527) to gain unauthenticated root code execution on a fully patched appliance; the flaws are in CISA's KEV catalog. Ivanti released versions 25.1.1.3 and 22.8R2.6, which the vendor says address all chained and exploited vulnerabilities. Upgrade now and check for signs of compromise: credential theft, data exfiltration and log tampering.

By HIFY Radar newsroom Updated 11/02/2026 05:01 AM Get this every day →← Back to the feed 3 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Attackers chained three zero-day flaws in the corporate VPN Ivanti Connect Secure and gained unauthenticated root access, even on an appliance fully patched at the time. Ivanti said a limited number of customers were hit. CISA listed the flaws in its KEV catalog following active exploitation.

Why it matters

According to Volexity, attackers stole credentials, exfiltrated data, scanned the network and tampered with logs. Organizations that installed the versions fixing the first flaw (25.1.1.2 or 22.8R2.5) must upgrade again. U.S. federal agencies face deadlines of November 2 and November 13.

What to do

Upgrade Ivanti Connect Secure immediately to 25.1.1.3 or 22.8R2.6, which fix the entire chain. Installing 25.1.1.2 or 22.8R2.5 is not enough: upgrade again. Review credentials, logs and data exfiltration.

For the technical team

CVE: CVE-2026-118527, CVE-2026-111357, CVE-2026-104935
Affected: Ivanti Connect Secure · Ivanti Connect Secure 25.1.1.2 and prior; 22.8R2.5 and prior (Ivanti, via SecurityWeek).
Exploitation: Active exploitation confirmed: CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog; CVE-2026-104935 has been in KEV since October 13. Volexity uncovered the exploitation while investigating a customer incident and attributed the activity to threat actor UTA0576; first signs on October 3. Defused reported attacks it believes targeted CVE-2026-104935 against its decoys starting October 1, before disclosure.
Fix: Upgrade to 25.1.1.3 or 22.8R2.6, which Ivanti says address all chained and exploited vulnerabilities. Organizations that installed 25.1.1.2 or 22.8R2.5 (the CVE-2026-104935 fix) must upgrade again. Federal deadlines: 2026-11-02 (CVE-2026-111357) and 2026-11-13 (CVE-2026-118527).
Vector: Component: Ivanti Connect Secure (VPN). Chain of three flaws: CVE-2026-104935 (authentication bypass), CVE-2026-111357 (missing authentication for critical function; privilege escalation by a local authenticated attacker; CVSS 8.8) and CVE-2026-118527 (predictable identifiers; a remote authenticated attacker uploads files with controlled content to a known disk location; CVSS 4.3). Chained, they yielded unauthenticated root code execution on an appliance fully patched at the time (Volexity).
More details: Ivanti said attacks chaining the three flaws hit a limited number of customers by disclosure time. Behavior observed by Volexity: credential theft, data exfiltration, network scanning and log tampering; the firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group. Part of the vulnerability was found through Ivanti's product security program and patched in 25.1.3.0, released in July; attacks took place while that fix was being brought to other supported releases. Ransomware use: unknown (CISA).

Timeline

11/02/2026 05:01 AM
Ivanti releases patches for zero-days CVE-2026-111357 and CVE-2026-118527, confirmed in an attack chain and listed in CISA KEV.
10/31/2026 06:14 AM
CISA added the flaws to its KEV catalog following active exploitation; CVE-2026-111357 (CVSS 8.8) is a missing authentication flaw for a critical function, chained with the others for unauthenticated root access.
10/30/2026 02:33 PM
Incident opened.