Patched your Ivanti VPN in October? Two more exploited flaws mean you need to update again.

What happened

Ivanti Connect Secure is the VPN appliance a lot of offices use so staff can reach the network from home. In October, attackers broke into these appliances with a chain of three flaws. The first, CVE-2026-104935, gets past the login without a password. CISA added it to its exploited list on October 13, and Ivanti released fixes.

The other two came out later. Rapid7, summarizing Ivanti’s updated advisory, describes CVE-2026-111357 as a privilege escalation that takes an attacker already on the appliance to full (root) control, and CVE-2026-118527 as predictable identifiers that let a signed-in user upload a file to a place they can guess. Ivanti rates them 8.8 and 4.3. On their own, both need a login. After the login bypass, they don’t.

Rapid7 also reports Volexity’s findings: an attacker Volexity tracks as UTA0576 had root on an appliance running 22.8R2.4 from October 3, stole credentials, and searched the company’s Active Directory for its computers’ local administrator passwords (LAPS) and BitLocker recovery keys. Volexity says Ivanti’s Integrity Checker Tool, which many administrators rely on to confirm an appliance is clean, did not catch the activity.

Which versions are affected

• 25.1.1.2 and earlier: update to 25.1.1.3.
• 22.8R2.5 and earlier: 22.8R2.6 is fixed, but Ivanti recommends moving the 22.8 line to 25.1.1.3.
• If you updated in October to 25.1.1.2 or 22.8R2.5, you’re protected from the login bypass but not from the two new flaws.
• On a different 25.1 release line, check Ivanti’s advisory for the fixed build that matches yours.

What to do

1. Find the versionWhoever manages the VPN can read it from the appliance’s admin page in a minute.
2. Update to 25.1.1.3 (or 22.8R2.6)Ivanti’s advisory, last updated October 29, lists both.
3. Don’t rely on a clean integrity check aloneIf the appliance ran an older version during October, assume it may have been entered and have it examined. Save its logs and, if you can, a memory capture before rebuilding or rebooting it, because both erase evidence.
4. Change the passwords that went through itEvery account that signed in over the VPN, and the service accounts the appliance uses to talk to Active Directory. If anything suggests your directory was searched, rotate the local administrator passwords and BitLocker recovery keys as well.

This is one of several office network devices on CISA’s list this fall; our firewall and router roundup covers the rest. If you think your VPN was already used to get in, our incident response team handles web, domain and email incidents and can tell you who to call for the rest.

Sources

• Ivanti security advisory: Connect Secure (CVE-2026-104935 and related)
• Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild
• Security Affairs: CISA adds Ivanti Connect Secure flaws to its catalog
• NVD: CVE-2026-111357
• NVD: CVE-2026-118527
• CISA Known Exploited Vulnerabilities catalog