CYBUNKR

Ivanti VPN zero-day chain gives attackers root, and the mid-October patch was not enough

Published

Attackers chained three Ivanti Connect Secure flaws to take over fully patched VPNs and steal Active Directory secrets. The last two were fixed on 29 October and CISA added them on 30 October. What to install and check.

If staff connect to your network through an Ivanti Connect Secure VPN (formerly Pulse Secure), check its version today, even if you patched it in mid-October. Ivanti says attackers chained three vulnerabilities, CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527, against a limited number of customers (Ivanti). Together they let an attacker who has not logged in run commands as root on the VPN appliance (Volexity).

Ivanti fixed the first flaw on 13 October. The fixes for the other two only arrived on 29 October, so a VPN updated in mid-October can still be exposed (Ivanti). CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on 30 October (CVE-2026-111357, CVE-2026-118527), after listing CVE-2026-104935 on 13 October.

Who is affected

Ivanti rates CVE-2026-104935 8.6, CVE-2026-111357 8.8 and CVE-2026-118527 4.3 out of 10. Affected and fixed versions (Ivanti):

  • CVE-2026-104935 (login bypass leading to command execution): 22.8R2.4 and earlier, 25.1.1.1 and earlier, and 25.1.2.2 and earlier. Fixed in 22.8R2.5, 25.1.1.2 and 25.1.3.0.
  • CVE-2026-111357 (privilege escalation to root) and CVE-2026-118527 (file upload to a predictable location): 22.8R2.5 and earlier and 25.1.1.2 and earlier. Fixed in 22.8R2.6 and 25.1.1.3.
  • Not affected: 22.7 and earlier, and 25.1.3.0 or later on the new ISA4500, ISA6500 and ISA8500 platform. Ivanti notes that 22.7 and 22.8 both reach end of life on 31 January 2027.

What has been seen so far

A snapshot from 31 October:

  • Volexity found an attacker it tracks as UTA0576 exploiting the chain from 3 October against an appliance on 22.8R2.4, which was fully patched at the time (Volexity).
  • Once in, the attacker took the LDAP and domain credentials stored on the VPN, used its Active Directory service account to search for LAPS administrator passwords and BitLocker recovery keys, sniffed LDAP traffic and ran password spraying against staff accounts (Volexity).
  • The attacker deleted entries from the appliance's logs and left no web shell, and Volexity says Ivanti's Integrity Checker Tool does not detect this chain because it only patches memory (Volexity). Volexity assesses with low confidence that the motive is criminal rather than espionage.
  • Canada's Cyber Centre says open-source reporting shows CVE-2026-111357 being exploited in the wild (AV26-1035). On CIRCL Vulnerability-Lookup, Shadowserver honeypot sightings flag CVE-2026-104935 as exploited, most recently on 29 October (CIRCL).

What to do

  • Upgrade to 22.8R2.6 or 25.1.1.3 (or run 25.1.3.0 or later on the new platform). The mid-October releases, 22.8R2.5 and 25.1.1.2, do not fix the last two flaws (Ivanti).
  • Check for compromise if it was exposed. If your VPN ran an affected version and was reachable from the internet in October, a clean Integrity Checker scan is not enough. Ivanti's recovery steps are to back up the configuration, factory reset or rebuild the appliance, upgrade it before putting it back online, restore the configuration and revoke and reissue the certificates stored on it.
  • Reset what the VPN could reach: the Active Directory service account and other credentials stored on the appliance, and, if you use them, local administrator (LAPS) passwords and BitLocker recovery keys, as these are what the attacker went after (Volexity).
  • If an IT provider runs your VPN, ask which Connect Secure version it is on, whether it is 22.8R2.6, 25.1.1.3 or 25.1.3.x, and whether they have checked it for signs of compromise since 3 October.
  • Plan the move off 22.x before it reaches end of life on 31 January 2027 (Ivanti).

How we can help

If you think your VPN or network has been accessed, our Incident Response service can help, or get in touch.

Sources