If you patched Ivanti Connect Secure after the 13 October advisory, you may still be exposed. Ivanti has since patched two more zero-days that attackers chained with the original authentication bypass, and the October builds do not contain those fixes. SecurityWeek reported on 2 November 2026 that attacks chaining all three flaws hit a limited number of customers before disclosure, and that the chain gave unauthenticated root code execution on an appliance that was fully patched at the time. This guide lists the three CVEs, the builds you need, and the cleanup steps. Facts come from the sources linked, read on 9 November 2026.
The three flaws and the builds you need
| CVE | What it is | Severity | In CISA KEV |
|---|---|---|---|
| CVE-2026-104935 | Authentication bypass in Connect Secure | Disclosed 13 October 2026 | 13 October 2026 |
| CVE-2026-111357 | Missing authentication for a critical function; local privilege escalation by an authenticated attacker | CVSS 8.8 | 30 October 2026; federal due date 2 November |
| CVE-2026-118527 | Predictable identifiers; an authenticated remote attacker can upload files to a known location on disk | CVSS 4.3 | 30 October 2026; federal due date 13 November |
The two newer issues affect Connect Secure 25.1.1.2 and earlier and 22.8R2.5 and earlier. They are fixed in 25.1.1.3 and 22.8R2.6. Those earlier versions, 25.1.1.2 and 22.8R2.5, were the builds that fixed the original CVE-2026-104935, so organizations that installed them in October must upgrade again. Ivanti says the latest release addresses all the vulnerabilities that were chained and exploited in the wild (SecurityWeek, CISA KEV catalog).
If you run a different release train, such as 25.1.2.x, do not assume the same version numbers apply. Check Ivanti's advisory for your train and for which build covers all three CVEs.
How the attack worked
Volexity found the exploitation while investigating an incident at one of its customers and attributes it to a previously unknown actor it tracks as UTA0576, which it assesses with low confidence to be criminally motivated rather than espionage. It saw the first signs on 3 October 2026; threat-intelligence firm Defused reported hits on its decoys from 1 October, before the vulnerability was public. By chaining the three flaws the attackers got unauthenticated code execution with root privileges. They focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs (SecurityWeek).
Ivanti says it found the attacks while its fix for CVE-2026-104935 was already in quality assurance, and shipped that fix without waiting because it closed the main route. Part of the vulnerability had been found by its own program and fixed in 25.1.3.0 in July, while the fix was still being brought to other supported releases.
What to do
- Check your build today. In the appliance's admin panel, read the version. 25.1.1.2 or 22.8R2.5 is not enough.
- Upgrade to 25.1.1.3 or 22.8R2.6 (or the build Ivanti lists for your train).
- Assume credentials that passed through the appliance may be exposed. The attackers stole credentials, so rotate passwords, API keys and certificates that the VPN held or authenticated, starting with administrators and service accounts.
- Hunt for compromise before and after patching. Look for unknown files, new accounts, unusual internal scanning from the appliance's address, and gaps or edits in logs. Because the attackers tampered with logs, absence of evidence is weak evidence. Do not rely only on the vendor's integrity checker; reports say it can miss this activity.
- If you find signs of compromise, save logs and memory first, then rebuild the appliance from a known-good state and follow Ivanti's and CISA's recovery guidance.
- Reduce exposure. Restrict the management interface to a private network and put the VPN portal behind monitoring.
This is the same lesson as other edge-device incidents this autumn: patching is not the end, you also rotate what the device saw. See Citrix NetScaler zero-days: rotate secrets after patching, and for another VPN firewall bug fixed this week read the SonicWall CVE-2026-19868 guide.
Frequently asked questions
I installed 25.1.1.2. Am I fixed? No. That build fixed only the original CVE-2026-104935. You need 25.1.1.3 for the two newer flaws.
Is any of this exploited? Yes. All three CVEs are in CISA's KEV catalog and were chained in attacks that hit a limited number of customers.
Do I need to reset passwords after patching? If the appliance was exposed, treat credentials it handled as potentially stolen and rotate them.
Who is behind the attacks? Volexity tracks the actor as UTA0576 and assesses with low confidence that it is criminally motivated.
