Ivanti Fixes the Root Flaw in an Exploited Connect Secure VPN Attack Chain, So Sites That Patched on 13 October Must Patch Again

Ivanti has released a second round of fixes for its Connect Secure virtual private network (VPN) appliance, closing the last link in a chain of zero-day flaws that attackers have been using since early October. A zero-day is a flaw that attackers use before the vendor has a fix. If your site patched Ivanti Connect Secure on 13 October, you are not done. The versions released that day still contain the flaw that lets an attacker take full control of the appliance, so you need to upgrade again.

What Ivanti published

On 29 October 2026, Ivanti updated its Connect Secure security advisory with fixes for two more vulnerabilities:

• CVE-2026-111357 lets an attacker who already has a foothold on the appliance become root, the all-powerful account on the device. Ivanti describes it as missing authentication for a critical function and rates it 8.8 out of 10, High, on the Common Vulnerability Scoring System (CVSS). Volexity, the security firm that found the attacks, describes it as a flaw in how an internal maintenance service on the appliance trusts its own cached configuration data.
• CVE-2026-118527 lets a logged-in attacker write files with content they choose to a known place on the appliance's disk. CVSS score 4.3, Medium.
• Both affect Connect Secure 25.1.1.2 and earlier and 22.8R2.5 and earlier. The fixed versions are 25.1.1.3 and 22.8R2.6, available for download in the Ivanti License Service. Ivanti says version 25.1.3.0 and later do not contain these flaws.

How the chain fits together

Ivanti says it is aware of exploitation affecting a limited number of customers when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained together. CVE-2026-104935 is the first link. It is an authentication bypass, meaning an attacker on the internet can get past the login, and it also lets them run commands on the appliance. Ivanti fixed it on 13 October in versions 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, and the Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog the same day. CVE-2026-111357 is the step that turns that access into root. Ivanti says it shipped the first fix right away rather than hold it for the privilege escalation fix. As of CISA's 29 October catalog release, CVE-2026-111357 and CVE-2026-118527 are not in the KEV catalog.

Volexity reports that the attacks began on 3 October 2026. It tracks the attacker as UTA0576, a group that has not been tied to any country or known actor. According to Volexity, the attacker ran its commands in memory without leaving a backdoor on the appliance, deleted entries from the appliance's logs, and went after stored domain credentials and other secrets. CISA warned on 13 October that Ivanti's Integrity Checker Tool, the built-in check for tampered files, may not detect this activity because the commands run in memory, and that network and memory forensics are needed to confirm a compromise. Volexity adds that attempts to move from the VPN appliance to other systems on the network are a sign to investigate.

Ivanti and CISA both note that the 22.8 line reaches end of life on 31 January 2027. Ivanti calls 22.8 a temporary bridge, recommends moving to 25.1.1.3 or later, and offers 22.8R2.6 for sites that cannot move yet.

Why this matters for plants

Ivanti Connect Secure is a common way for vendors, integrators and plant engineers to reach operational technology (OT) networks from outside. It often lands remote users in the demilitarized zone (DMZ), the buffer network between the business and control networks, on jump hosts and historians. The appliance also holds the credentials it uses to check logins, often domain service accounts. An attacker with root on it can see who connects, collect those credentials and use the appliance as a starting point toward the systems behind it. Because this attacker cleaned logs and left nothing behind on disk, a clean Integrity Checker result is not proof that you are safe.

Where it shows up, plant floor to cloud

At the enterprise edge, the Connect Secure appliance faces the internet and checks users against the corporate directory. In the industrial DMZ, the VPN lands remote users on jump hosts, patch servers and historian copies. Below that, engineering workstations, human-machine interfaces (HMIs) and controllers can be reached from those jump hosts. Whoever controls the VPN path has a route toward the control room and field devices, unless access from the VPN is tightly limited.

What owners should do now

1. Upgrade to 25.1.1.3 or 22.8R2.6 now, even if you patched on 13 October. Versions 25.1.1.2 and 22.8R2.5 still carry the root escalation flaw. Ivanti recommends 25.1.1.3 or later where you can.
2. If the appliance was reachable from the internet before you patched, treat it as possibly compromised. Do not rely on the Integrity Checker Tool alone. Review VPN and firewall logs kept off the appliance, look for connections that start from the VPN appliance into the OT network or DMZ, and follow Ivanti's recovery steps if anything looks wrong. Change passwords for accounts stored on or passing through the appliance, including domain service accounts, and revoke and reissue its certificates.
3. Limit what VPN users can reach in OT. Land remote users on a jump host only, which is a single hardened server for remote work, require multi-factor authentication (MFA), and give vendors time-limited access that is turned on only when needed.
4. Plan the move off 22.8 before 31 January 2027, including any new hardware or virtual appliance rebuild that Ivanti's 25.1 migration guide calls for.

Red Tiger Security has completed 500+ plant-safe operational technology (OT) assessments and trained 4,500+ engineers and operators. Our team can help you map every remote access path into your plants, limit what each VPN user and vendor can reach, and set up 24x7 monitoring that flags connections starting from the VPN appliance.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources
Ivanti, Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated 29 October 2026 with CVE-2026-111357 and CVE-2026-118527: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
CISA alert, "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure," 13 October 2026: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days," 13 October 2026, updated 29 October: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
The Stack, "Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation," 29 October 2026: https://www.thestack.technology/ivanti-patches-two-more-cves-amid-highly-unusual-connect-secure-exploitation/
CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

‍