Ivanti Connect Secure Zero-Days: Patch and Check

Field notes from the engineering team

On October 13, 2026, Ivanti disclosed CVE-2026-104935, a flaw in Ivanti Connect Secure (ICS), its VPN appliance. The same day, the security firm Volexity published how attackers had used it, together with a second flaw, to take full control of a fully patched appliance. On October 29, Ivanti released fixes for two more flaws in the same attack chain. CISA added the first CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13 and the other two on October 30.

A VPN appliance sits at the edge of your network and holds the credentials it uses to look people up in Active Directory. When it falls, the attacker gets a foothold and a set of keys. If you run Ivanti Connect Secure, or a vendor runs it for you, check the version today.

The short version

Item	Detail
CVEs	CVE-2026-104935, CVE-2026-111357, CVE-2026-118527
Product	Ivanti Connect Secure (ICS) VPN appliance
Severity	High. Ivanti rates CVE-2026-104935 at CVSS 8.6, CVE-2026-111357 at 8.8 and CVE-2026-118527 at 4.3.
What the chain does	Remote, unauthenticated command execution, then privilege escalation to root.
Exploitation	Ivanti and CISA confirm exploitation in the wild. Volexity saw it from October 3, 2026.
Fix	ICS 25.1.1.3 or later, 25.1.3.0 or later, or 22.8R2.6. Versions are listed below.
Check	Patching does not remove an attacker who is already in. Follow the steps below.

Which versions are affected

Ivanti lists two sets of affected versions, because the first fix came on October 13 and the other two came on October 29.

CVE	Affected	Fixed
CVE-2026-104935	25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior	25.1.1.2, 25.1.3.0, 25.1.3.1, 22.8R2.5
CVE-2026-111357 and CVE-2026-118527	25.1.1.2 and prior, 22.8R2.5 and prior	25.1.1.3, 22.8R2.6

Ivanti says ICS 22.7 and earlier do not contain these flaws. Its guidance by branch:

• 22.8.x: update to 25.1.1.3 or later. If you cannot move yet, 22.8R2.6 fixes all three flaws.
• 25.1.1.1 on ISA6000 or ISA8000: update to 25.1.1.3.
• 25.1.3.0 or later: not affected by these flaws. This release needs the newer ISA4500, ISA6500 or ISA8500 hardware, or a new virtual or cloud appliance built from the 25.1.3.0 template.

Both 22.7 and 22.8 reach end of life on January 31, 2027. Ivanti calls 22.8 a temporary bridge to the 25.1 line.

How the attack worked

Volexity found the attack while investigating a suspected intrusion at one of its customers in early October 2026. The appliance was on 22.8R2.4, the latest release at the time. Volexity tracks the attacker as UTA0576. It describes three steps:

1. Authentication bypass. A request to the public login page names a different, protected script in a request header. The appliance checks the public URL but runs the script named in the header.
2. Remote code execution. The attacker uploads a script disguised as a ZIP file. The upload handler writes the file to disk before checking it. The attacker races to run it before it is deleted. These two steps are CVE-2026-104935.
3. Privilege escalation to root. The attacker tricks a background service on the appliance into running a malicious script as root. This is CVE-2026-111357.

CVE-2026-118527 is a related flaw: a remote attacker who is logged in can upload files with chosen content to a known location on disk. CISA says all three can be chained.

Once inside, Volexity says UTA0576 pulled the credentials stored on the appliance, including domain credentials used for LDAP. It then searched Active Directory for Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys. It also ran password spraying and removed traces of its activity from the appliance’s logs.

Two details matter for defenders. The attacker passed commands through the same HTTPS requests as the exploit and left no web shell on the device. And CISA warns that Ivanti’s Integrity Checker Tool may not detect exploitation of CVE-2026-104935, because the commands run in memory. A clean integrity scan does not show the appliance is clean.

Ivanti says it knows of exploitation against a limited number of customers. Volexity’s write-up describes one intrusion.

What to do

1. Find out whether you run it. Ask your IT provider: “Do we have an Ivanti Connect Secure VPN, and which version is it on?” Include virtual and cloud appliances.

2. Update. Move to a fixed release from the list above. If the appliance is on hardware that cannot run 25.1.3.0, plan the hardware swap. Put the January 31, 2027 end-of-life date on the calendar now.

3. Decide whether it may already be compromised. Our advice: if the appliance was reachable from the internet on an affected version at any point since early October, treat it as suspect. CISA says that confirming or ruling out a compromise takes network and memory forensics.

4. If you suspect a compromise, follow Ivanti’s recovery steps. CISA’s summary of them:

• Back up the appliance configuration.
• Factory reset the appliance and upgrade it to the latest version. For virtual or cloud appliances, rebuild the instance and upgrade.
• Restore the configuration from the backup.
• Reset passwords for all accounts, including domain, administrator and local accounts. Revoke and reissue stored certificates, and reset stored API keys and license server credentials.

5. Rotate what the appliance could read. Our advice: change the password of the service account the VPN uses to query Active Directory, and check what that account can see. Volexity saw the attacker look for LAPS passwords and BitLocker recovery keys, so confirm that account cannot read them, and rotate any it could.

6. Watch for lateral movement. Volexity advises forensic review of systems showing attempts to move sideways from the VPN appliance. Look in your logs for unusual logins or directory queries that start at the appliance’s address.

7. Ask whether you still need a VPN appliance. An internet-facing VPN is one of the most targeted pieces of equipment on a small network. Access tied to a user and a device, with nothing listening on the public internet, shrinks that exposure.

How we help

We keep track of what version your edge devices run through remote monitoring and patching, so a question like “are we on a fixed release?” has a quick answer. If you want to stop exposing a VPN login to the internet, zero trust access replaces it with access tied to identity and device. A VPN appliance that behaves oddly is the kind of signal our managed SOC reviews. If an appliance may be compromised, incident response covers isolating it, preserving evidence, and resetting credentials.

For municipalities, law firms and healthcare practices, remote access often runs through one appliance, and the credentials on it open the rest of the network. If you are not sure what your VPN is or who maintains it, ask us and we will help you find out.

We recently covered another exploited VPN flaw in Cisco ASA and FTD VPN Flaw: Remote Reload Bug.

Sources

• Ivanti: Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated October 29, 2026
• CISA: CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (last revised October 30, 2026)
• Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (October 13, 2026)
• CISA Known Exploited Vulnerabilities catalog
• NVD: CVE-2026-104935
• NVD: CVE-2026-111357