Attackers have been chaining flaws in Ivanti Connect Secure VPN appliances to run code as root without logging in, according to security firm Volexity. On October 30, CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities (KEV) list, and one federal deadline lands tomorrow, November 2.
What happened
Volexity published research on October 13 describing a chain of zero-day bugs in Ivanti Connect Secure. It says the activity began on October 3 and that it started investigating on October 5. The first bug is an authentication bypass in the appliance’s login component. A second, a race condition, lets an attacker run a script on the device. A third step escalates to root. Volexity tracks the operator as UTA0576, an unknown actor, and assesses with low confidence that the motive is criminal rather than espionage.
After gaining access, the actor went after credentials, Volexity reports: LDAP domain credentials, LAPS local-admin passwords and BitLocker recovery keys. It also ran password spraying and sniffed traffic on the device. Volexity found no web shell or backdoor, and says Ivanti’s Integrity Checker Tool may not detect the compromise because the chain alters memory and then restores configuration data.
Volexity says the authentication bypass and code execution flaw is CVE-2026-104935, patched on October 13. The privilege escalation flaw, CVE-2026-111357, received a patch on October 29, according to an update on Volexity’s post. Security Affairs reports that CISA added CVE-2026-111357 (CVSS 8.8) and a second flaw, CVE-2026-118527 (CVSS 4.3, a file-upload issue), to KEV on October 30, with federal due dates of November 2 and November 13. CVE-2026-104935 (CVSS 8.6) was added on October 13. We could not open CISA’s alert or Ivanti’s advisory during our checks, so the CVSS scores and due dates come from that secondary report.
Who is affected
Organizations running Ivanti Connect Secure, especially internet-facing appliances. Volexity says the exploits affect versions up to 22.8R2.4, and that its victim was fully patched on that build when it was hit. Security Affairs lists fixed builds as 25.1.1.3 for the 25.1 line and 22.8R2.6 for the 22.8 line. U.S. federal agencies are bound by the KEV deadlines; everyone else should treat them as a guide.
What to do
- Upgrade to the newest Connect Secure release and confirm the build against Ivanti’s security advisory, since the patches arrived in stages (October 13 and October 29).
- Hunt for signs of compromise. Volexity advises watching for many requests to welcome.cgi, requests where the URL path and the X-DSCGI-PATH header do not match, and leftover files in /tmp and /data/.icscap on the appliance. Its published indicators are on its blog and GitHub.
- Do not rely on the Integrity Checker Tool alone. If you suspect a breach, capture network and memory data and involve incident responders.
- Our analysis: if an appliance was exposed before patching, rotate Active Directory service credentials used by the VPN, LAPS passwords and BitLocker recovery keys, and review password-spray activity against your domain.
What we still do not know
Ivanti’s own advisory text is not something we could review, so exact affected ranges for each CVE are unconfirmed. Volexity does not say how many organizations were hit, and has not named victims. It is also unclear whether any earlier fixed release, such as Ivanti’s July 25.1.3.0, covers all three flaws; one secondary report flags this as unresolved. Check the vendor advisory before assuming you are safe.
Sources: Volexity, Oct 13, 2026 (updated Oct 29); Security Affairs, Oct 31, 2026; SiteGuarding, Oct 31, 2026.
Leave a Reply