Ivanti Connect Secure: three flaws used in attacks since October, update and check for compromise

What happened

Ivanti Connect Secure is a VPN appliancea server that lets employees connect to a company network from outside; it sits on the internet, which makes it an attractive target used by companies and public agencies. On October 13, 2026, CISA added the first flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalogCISA's public list of flaws with evidence of use in real attacks and urged organizations to patch. On October 30 it updated that alert and added two more, CVE-2026-111357 and CVE-2026-118527. Ivanti published the CVE record for the last one on November 3.

CISA says the flaws together allow remote, unauthenticated execution of arbitrary commands, and that attackers are using them for credential theft and data exfiltration. It recommends Volexity's research on the chained exploitationattackers combine several smaller flaws in sequence, so each one opens the door to the next of these zero-daysflaws that attackers used before the vendor had a fix available for the technical details.

The three flaws

The first flaw is an authentication bypass. Ivanti's CVE record says it lets a remote attacker who has not logged in execute arbitrary commands on versions before 25.1.3.0. Ivanti scored it 8.6 on CVSS 3.1.

The second lets an attacker gain root, the highest level of control on the appliance. The record, written by MITRE, says the dsinvoked broker trusts DSCache configuration data in a way it should not, and that the flaw was "exploited in the wild in October 2026". Its vector is local, which fits a step used after the attacker is already inside.

The third lets an attacker who is already authenticated upload files with content they control to a predictable location on disk. Its CVSS score of 4.3 looks mild on its own. In a chain, a reliable way to place a file where the attacker expects it can be the missing step, and CISA lists it as exploited.

Which versions to install

The sources do not line up perfectly. CISA's alert lists Connect Secure 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected. The CVE records name 25.1.1.3 and 22.8R2.6 as fixed for CVE-2026-118527, and 25.1.3.0, 25.1.3.1 and 22.8R2.5 as not affected by CVE-2026-104935. The record for CVE-2026-111357 does not name a fixed version.

Take the build number from Ivanti's own advisory, linked below, and install the newest release for your branch. CISA also notes that Connect Secure 22.8 reaches end of life on January 31, 2027, so plan the move off that branch.

What to do now

1. Update the appliance to the latest version in Ivanti's advisory, following Ivanti's upgrade guide for hardware or virtual appliances.
2. Check whether you were already compromised. CISA warns that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935, because the attacker's commands run in memory. It recommends network and memory forensics.
3. If you suspect compromise, back up the configuration, factory reset the appliance and upgrade it. Rebuild virtual and cloud instances. Then restore the configuration.
4. Reset the passwords of every account that used the appliance, revoke and reissue the certificates stored on it, and reset stored API keys and license server credentials.

Still unknown

CISA has not named the attackers or said how many organizations were affected. We found no public proof-of-concept code, and the details of the chain come from Volexity's research rather than from Ivanti. We will update this article if Ivanti or CISA publish more.

The same weeks brought other exploited flaws. Our roundup of the CISA list from October 26 to 29 covers a Cisco firewall VPN flaw that also targets remote access, and the exploited WordPress upgrade flaw shows a different kind of attack window.