Ivanti has fixed two Connect Secure zero-days that, chained with an authentication bypass patched in October, let attackers run code as root without credentials. They have been exploited since at least 1 October. If your company uses this VPN, update today to 25.1.1.3 or 22.8R2.6, check for intrusion and rotate passwords and certificates.
The essentials
- CVE-2026-111357 (CVSS 8.8) is a local privilege escalation caused by missing authentication for a critical function. CVE-2026-118527 (CVSS 4.3) lets an authenticated attacker upload files to a known location on disk (SecurityWeek).
- They are chained with CVE-2026-104935, an authentication bypass Ivanti fixed in October. According to Volexity, the chain achieves unauthenticated code execution as root (The Hacker News).
- Affected: 25.1.1.2 and earlier and 22.8R2.5 and earlier. Fixed in 25.1.1.3 and 22.8R2.6. CISA also lists 25.1.2.2 and earlier as affected (CISA).
- The chain has been used as a zero-day since at least 1 October (BleepingComputer).
- CISA added the two new flaws to its KEV catalogue on 30 October. CVE-2026-104935 has been listed since 13 October.
Does this affect me if I don't know which VPN we use?
Only if you use Ivanti Connect Secure (formerly Pulse Secure) as your remote access VPN and the appliance is exposed to the internet, on either the 25.1 or the 22.8 branch. You may not manage it yourself: if you have an IT provider, the VPN may sit on their side without your team knowing.
The worrying part: attackers got root even on a device that was fully patched at the time. Updating in October was not enough. You need the new version.
Is installing the patch enough?
No. The patch closes the door, but it doesn't remove anyone already inside. Volexity attributes the activity to a previously unknown actor, UTA0576. According to SecurityWeek, it focuses on stealing credentials, exfiltrating data, scanning the network and tampering with logs. According to Volexity, it has also hunted for administrator passwords and BitLocker recovery keys, and extracted credentials and limited Active Directory metadata (The Hacker News).
Log tampering matters: reviewing logs may not show you everything. That is why CISA recommends resetting passwords for all accounts (domain, administrator and local), revoking and reissuing stored certificates, and resetting API keys and licence server credentials.
What to do today
- Ask whoever manages your VPN whether it is Ivanti Connect Secure and exactly which version it runs.
- If it is, update to 25.1.1.3 or 22.8R2.6. If you are on the 25.1.2.x branch, check Ivanti's advisory, because CISA lists it as affected.
- If the appliance has been exposed to the internet since October, treat it as possibly compromised: review logs and unusual access.
- Reset domain, administrator and local passwords. Revoke and reissue stored certificates. Reset API keys and licence server credentials.
- Review BitLocker recovery keys and Active Directory credentials, which are exactly what this actor is after.
What it means for an SME
Your VPN is the front door to your network and, by design, it faces the internet. This case shows that patching fast doesn't always protect you: for a month, an up-to-date appliance could still fall. Ivanti fixed one flaw in October and now has had to fix two more that combined with it.
Our view: if you use Connect Secure, assume the patch is half the job. The other half is checking whether someone got in and changing everything they could have stolen. Rotating domain credentials in a 50-person company is a nuisance, but far cheaper than leaving an attacker with the keys.
And if reading this you don't know which VPN you use or who maintains it, that is the underlying problem. Get it in writing: which device it is, which version it runs and who responds when an advisory like this lands, with deadlines. If you need help reviewing it, see our cybersecurity service.
Frequently asked questions
If I updated in October, am I safe?
No. The chain worked even on devices that were fully patched at the time. You need 25.1.1.3 or 22.8R2.6 and to check for intrusion.
What if my VPN isn't from Ivanti?
Nothing to do for this story. But you should know which VPN you use and who maintains it.
Why change passwords if I've already patched?
Because the actor steals credentials and the patch doesn't invalidate them. That's why CISA asks you to rotate them, along with certificates and API keys.
Sources
- SecurityWeek – Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
- CISA – Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure
- The Hacker News – Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
- BleepingComputer – Ivanti patches two more Connect Secure zero-days chained in attacks
