, front page
InitialReach
How we report

SecurityIvanti Connect SecureChanged

Two more exploited flaws in Ivanti's Connect Secure VPN, and later versions now affected, CISA's revised alert shows

The US Cybersecurity and Infrastructure Security Agency (CISA) revised its alert on Ivanti Connect Secure, a VPN appliance companies use for remote access, on 30 October. It now names three exploited vulnerabilities instead of one, and its affected versions now include 25.1.1.2 and 22.8R2.5.

CISA added the two new flaws, CVE-2026-111357 and CVE-2026-118527, to its catalog of vulnerabilities known to be exploited the same day, and says they can be chained with CVE-2026-104935, listed on 13 October, which lets an attacker run commands without logging in. Volexity, the security firm that found the attacks, says Ivanti released a fix for the privilege-escalation flaw on 29 October.

According to Volexity, the attackers broke into an appliance that had every update available at the time, version 22.8R2.4, and went after Active Directory credentials, including LAPS administrator passwords and BitLocker recovery keys.

Exploited flaws named in CISA's Connect Secure alert

Before: OneNow: Three

What changed

Before CISA alert on Ivanti Connect Secure, as published on 13 October (Internet Archive copy of 23 October), 13 October 2026Now CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure, 30 October 2026

  1. Flaws named

    Before

    CVE-2026-104935, an authentication bypass

    Now

    Also CVE-2026-111357 and CVE-2026-118527, which CISA says can be chained with it

  2. Affected versions, 25.1.1 line

    Before

    25.1.1.1 and earlier

    Now

    25.1.1.2 and earlier

  3. Affected versions, 22.8 line

    Before

    22.8R2.4 and earlier

    Now

    22.8R2.5 and earlier

  4. In CISA's Known Exploited Vulnerabilities catalog

    Before

    CVE-2026-104935, added 13 October

    Now

    CVE-2026-111357 and CVE-2026-118527 added on 30 October

  5. Deadline for US federal civilian agencies

    Before

    16 October, for CVE-2026-104935

    Now

    Also 2 November for CVE-2026-111357 and 13 November for CVE-2026-118527

What stayed the same

  • Affected versions on the 25.1.2 line: 25.1.2.2 and earlier.
  • CISA says the flaws allow remote, unauthenticated execution of commands, used for credential theft and data exfiltration.
  • Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935, CISA says, because the attackers' commands run in memory.
  • Version 22.8 reaches end of life on 31 January 2027.

What we don't know yet

  • Which versions fix all three flaws. CISA's alert does not list fixed versions, and Ivanti's advisory, which it links, refused our requests.
  • Who is behind the attacks. Volexity tracks the group as UTA0576 and calls it an unknown threat actor.
  • How many appliances were attacked.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
Identifiers
CVE-2026-104935, authentication bypass by spoofing (CWE-290), CVSS 3.1 base 8.6. CVE-2026-111357, missing authentication for a critical function: the dsinvoked broker trusts DSCache configuration data, giving privilege escalation to root; CVSS 3.1 base 7.0, local vector. CVE-2026-118527, predictable numbers or identifiers (CWE-340): an authenticated attacker can upload files with attacker-controlled content to a known location on disk.
Chain
Per Volexity: an authentication bypass in welcome.cgi, remote code execution and privilege escalation to root; CVE-2026-104935 covers the first two. Commands and results travelled inside the exploit's own HTTPS requests, with no separate command-and-control channel, backdoor or web shell on the device.
Post-exploitation
Per Volexity: LDAP queries to a domain controller through the appliance's Active Directory service account for LAPS passwords, BitLocker recovery information and password-bearing attributes; collection of the appliance's configuration; password spraying. Evidence was deleted from Ivanti debug logs and Linux audit logs.
Timeline
5 October, Volexity begins investigating; 13 October, CVE-2026-104935 published and listed in KEV; 15 October, CVE-2026-111357 published, its description already noting exploitation in October; 29 October, Ivanti's fix for CVE-2026-111357 (per Volexity); 30 October, CVE-2026-111357 and CVE-2026-118527 listed in KEV and CISA's alert revised.
Federal deadlines
Under CISA's Binding Operational Directive 26-04: 16 October for CVE-2026-104935, 2 November for CVE-2026-111357, 13 November for CVE-2026-118527. The catalog marks forensic triage as required for the first two, not the third.