On 30 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. Security firm Volexity reported that attackers chained a privilege escalation flaw, CVE-2026-111357, with an earlier zero-day to take over VPN appliances and steal stored credentials; CISA notes the new flaws can be chained. Ivanti released fixes on 29 October.
What happened
- 3 October 2026, first exploitation seen. Volexity reported that an attacker it tracks as UTA0576 began exploiting a chain of three zero-day flaws in Ivanti Connect Secure, a remote-access VPN gateway. Volexity started its investigation on 5 October and published its findings on 13 October. The appliance it examined was running a version that was fully patched at the time.
- How the chain works. An authentication bypass and code execution flaw (CVE-2026-104935) gave the attacker a way in without logging in. A privilege escalation flaw then gave root-level control. Volexity found no backdoor or web shell: the attacker ran commands through the exploit channel itself, which makes the activity harder to spot.
- What the attacker did next. According to Volexity, the attacker extracted credentials stored on the appliance, such as LDAP domain credentials, queried Active Directory for local administrator passwords and BitLocker recovery keys, ran password spraying and removed recent log entries.
- 29 October 2026, the fix for the last flaw. Ivanti published a patch for the privilege escalation flaw, now tracked as CVE-2026-111357, and for a related file upload flaw, CVE-2026-118527. The Stack reported the fixed releases as 25.1.1.3 and 22.8R2.6, with versions up to 25.1.1.2 and 22.8R2.5 affected.
- 30 October 2026, the CISA listing. CISA's catalog describes CVE-2026-111357 as a missing authentication flaw that lets a local authenticated attacker escalate privileges, and CVE-2026-118527 as a flaw that lets a remote authenticated attacker upload attacker-controlled files. CISA set a 2 November deadline for the first and 13 November for the second, and marked the first as requiring forensic triage.
What it means for businesses
The CISA deadlines apply to US federal civilian agencies, but a catalog listing tells every organisation that these flaws are being used in real attacks. A VPN gateway sits between the internet and your internal network, so a compromised one can expose far more than the appliance itself.
Two points matter most:
- Patching alone may not be enough. Volexity reports that it found no backdoor or web shell, and that the vendor's integrity checker may not detect compromise. An appliance that was exposed before the patch may already have had its stored credentials read.
- Stored directory credentials are the real prize. If a gateway holds a directory service account, an attacker who reads it can try to move into the wider network.
What to do next
- List every Ivanti Connect Secure appliance you run, including ones managed by a supplier, and note the version.
- Apply the vendor fixes and upgrade any release that Ivanti and Volexity list as affected.
- Treat appliances that were exposed in October as possibly compromised. Volexity recommends network and memory forensics where compromise is suspected, rather than relying only on the built-in integrity tool.
- Review logs for unusual requests to the appliance's login paths and for unexpected directory queries or password-spray patterns since early October.
- Consider rotating credentials held by or reachable from the appliance, such as the LDAP service account. This is a precaution, not a step the sources require.
- Limit who can reach the management and login interfaces from the internet where your setup allows it.
- Agree a patch target for critical fixes, and keep the logs long enough to investigate later.
For background on keeping systems current, see our guide on what software maintenance covers and our security and data protection page.
Timeline Digital, a custom software development company founded in 2013 in Islamabad, builds and runs custom software as managed projects, including DevOps and cloud infrastructure work such as monitoring and patching for the systems we deliver. Every project starts with a free pilot: Before you commit to the full project, we build 2 to 3 of your key modules as working software, free of charge, ready in about 2 days. Your team tests the pilot, and the full build starts only after you approve it.
Sources
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, Volexity, 13 October 2026 (updated 29 October 2026)
- CISA Known Exploited Vulnerabilities Catalog, CISA, entries added 30 October 2026
- Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation, The Stack, 29 October 2026