Ivanti Connect Secure: attackers chain flaws to take over VPN gateways

What happened

Ivanti Connect Secure is a VPN gateway that lets employees connect to the company network from outside. In the first week of October 2026, security firm Volexity found that an unknown group it tracks as UTA0576 had broken into such a gateway even though it had every update available at the time installed (version 22.8R2.4). According to Volexity, the attacks began on October 3, 2026.

The attackers combined three flaws. The first, CVE-2026-104935, lets them bypass login and run their own code. Ivanti fixed it on October 13, 2026. The other two are CVE-2026-118527 (uploading files to a predictable location on disk) and CVE-2026-111357 (gaining the highest, root, privileges). Ivanti released a fix for these on October 29, 2026.

On October 30, 2026, the US agency CISA added both of the later-fixed flaws to its catalog of actively exploited vulnerabilities. The European database EUVD lists CVE-2026-111357 as exploited since October 30, 2026. CISA has not yet said whether ransomware groups are using these flaws.

Why it is dangerous

Each flaw gives the attacker only part of what they need. Together, though, they work like three keys to the same building. The first opens the front door without a password, the second lets the intruder leave their own tools inside, and the third unlocks the admin room. The result, according to Volexity: an attacker on the internet runs commands on the device as root, with full control and no login at all.

CVE-2026-111357 is a flaw in how an internal system service trusts shared configuration data. Someone who already has limited access to the device can use it to run their own code with the highest privileges. On its own it scores CVSS 7.0 (version 3.1, assigned by MITRE) because it needs local access and low privileges. The Hacker News reports a score of 8.8 for it and 4.3 for CVE-2026-118527. CVSS is a 0 to 10 scale describing how severe a flaw is, not whether it is actually being exploited.

A VPN gateway is an extremely sensitive spot. It sits at the network edge, faces the internet and stores domain credentials. Volexity found the attackers stole domain passwords used for LDAP, searched Active Directory for local admin passwords (LAPS) and BitLocker recovery keys, and tried passwords on other accounts. The gateway became a springboard deeper into the network.

The CISA KEV catalog lists flaws CISA has evidence are being exploited. EPSS estimates the chance of exploitation in the next 30 days: for CVE-2026-111357 it is only 0.3%. A low number does not mean safety here, because exploitation is already confirmed.

Who is affected

This affects organizations running Ivanti Connect Secure, a VPN gateway for remote access by employees, contractors or branch offices. Vulnerable versions are 22.8R2.5 and earlier and 25.1.1.2 and earlier. Volexity confirmed the real-world attack on version 22.8R2.4 (Build 19097).

Watch out: the October 13, 2026 update is not enough. It fixed only CVE-2026-104935, not the whole chain. If you have not moved to 22.8R2.6 or 25.1.1.3 since then, your gateway may still be vulnerable. Ivanti also said it found part of the problem itself and fixed it in the July release 25.1.3.0. For that and any other version, follow the vendor advisory.

If you do not use Ivanti Connect Secure, these flaws do not affect you. Neither Volexity nor The Hacker News mentions other Ivanti products in connection with this attack.

How to check if you are affected

You can find the version in the Ivanti Connect Secure admin web console. After logging in, look at the system status overview (System Status), which shows the release number and build. Just viewing the version changes nothing.

22.8R2.5 or lower: vulnerable, update to 22.8R2.6
25.1.1.2 or lower: vulnerable, update to 25.1.1.3
22.8R2.6 or 25.1.1.3: the flaws in this chain are fixed
any other version, such as 25.1.3.0: check its status in the Ivanti advisory

Also confirm whether the gateway is reachable from the internet. For a VPN it almost always is, and those are exactly the devices the attackers targeted.

How to fix it

On October 29, 2026, Ivanti released an update. According to The Hacker News, the new release fixes all flaws exploited in this chain.

22.8 branch: update to 22.8R2.6
25.1 branch: update to 25.1.1.3

Recommended steps:

Check your version and read the Ivanti advisory for CVE-2026-104935, which contains the vendor’s upgrade instructions.
If you suspect an attack (see below), talk to an expert before updating. The attackers worked mainly in the device’s memory, and a reboot can destroy evidence.
Install the fixed version as soon as possible, ideally in your next maintenance window.
After updating, change the passwords of accounts the gateway uses to log in to the domain, such as the LDAP service account.
Check the version again to confirm the update succeeded.

Neither Volexity nor The Hacker News mentions a workaround that would replace updating. CISA requires US federal agencies to fix CVE-2026-111357 by November 2, 2026 and CVE-2026-118527 by November 13, 2026. For businesses, that is a good indication of how urgent this is.

What if you may already be compromised

This is the hardest part. According to Volexity, the attackers wiped traces from the Ivanti debug log and the Linux audit log, installed no backdoor or web shell, and the Ivanti Integrity Checker Tool does not catch them because the changes were made only in memory. A clean scan result therefore proves nothing.

What to look for:

login or connection attempts from the VPN gateway’s IP address to other internal servers, which Volexity cites as an example sign of compromise
unusual LDAP queries from the gateway to domain controllers, especially for LAPS passwords and BitLocker recovery keys
Kerberos ticket requests for service accounts (Kerberoasting) and waves of failed logins across many accounts
missing or interrupted entries in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log
unexpected memory dumps (core dumps) created during exploitation

If you find any of this, or the gateway was internet-facing on a vulnerable version since October 3, 2026, bring in forensic experts and contact Ivanti support. Volexity needed memory and disk images, which a typical admin cannot handle alone. Change passwords of domain accounts the gateway used, and assume LAPS passwords and BitLocker keys may have leaked.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.