Ivanti Connect Secure: three exploited flaws, and the first fix wasn't enough

Ivanti Connect Secure is the VPN that many companies, universities and government agencies use to let staff into their networks. In October attackers broke into these appliances with a chain of three flaws, and the first fix Ivanti shipped did not stop them. All three flaws are now on CISA's list of exploited vulnerabilities. If your organisation runs one, it needs the second update, not just the first.

What happened

• July Ivanti found part of the problem through its own security programme and fixed it in version 25.1.3.0. The fix for older supported versions was still being prepared when the attacks began (SecurityWeek).
• 1 Oct The security firm Defused saw attacks it believes targeted the first flaw on its decoy appliances, before anything was public (SecurityWeek).
• 3 Oct First signs of the break-in that Volexity later investigated at one of its customers, on an appliance running 22.8R2.4.
• 13 Oct Ivanti disclosed the first flaw, CVE-2026-104935, an authentication bypass rated 8.6, and released 25.1.1.2 and 22.8R2.5. CISA added it to its list of exploited vulnerabilities the same day. Ivanti shipped this fix before the rest was ready because it closed the main way in.
• 29 Oct Ivanti updated its advisory with two more flaws used in the same attacks and released 25.1.1.3 and 22.8R2.6 (Rapid7).
• 30 Oct CISA added both to its list and gave US federal agencies until 2 November and 13 November to fix them.

The three flaws

• CVE-2026-104935, authentication bypass (Ivanti: 8.6, high). Lets an attacker who isn't logged in run commands on the appliance.
• CVE-2026-111357, privilege escalation (Ivanti: 8.8, high; the CVE record says 7.0). Turns that foothold into full control (root).
• CVE-2026-118527, predictable file names (4.3, medium). Lets a logged-in attacker upload a file to a place on disk they can predict.

Alone, the second and third look moderate. Chained behind the first, they gave the attackers root on appliances that had every update available at the time (SecurityWeek, Rapid7).

Ad Get Proton VPN today ›

What the attackers did

Volexity tracks the group as UTA0576, a name for a group it hadn't seen before, and thinks with low confidence that it is criminal rather than spying for a government. Once inside, the attackers stole credentials, queried Active Directory for Windows LAPS passwords and BitLocker recovery keys, scanned the network, took data out and deleted parts of the appliance's logs. According to Volexity, Ivanti's own Integrity Checker Tool does not detect this activity, so a clean result proves nothing. Ivanti says "a limited number of customers" were hit; nobody has published a number.

What to do

1. Update now to 25.1.1.3 or 22.8R2.6 (or 25.1.3.0 and later), even if you already installed the 13 October update.
2. Check for a break-in afterwards. Updating doesn't remove attackers who are already in. Rapid7 advises saving memory and logs before a reboot or reset, looking for requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header, and checking the logs for gaps.
3. If in doubt, assume the worst: follow Ivanti's recovery steps and change every password, key and token the appliance could see, including the Active Directory accounts it uses.

Why this is on Blackout Map

This is a software flaw, not an outage, and it won't show on our map. We cover it because VPN appliances like this one keep coming back: Ivanti Connect Secure has had several exploited flaws in recent years, and three in October alone. Our Security watch lists every flaw CISA adds to its catalogue, including CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527. Read also Can a software flaw take the internet down?

Sources

• Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
• SecurityWeek: Ivanti patches two more zero-days exploited in Connect Secure attack chain (Volexity, Defused, Ivanti's statements)
• HKCERT: Ivanti Connect Secure multiple vulnerabilities
• CISA: Known Exploited Vulnerabilities catalog