Attackers chain Ivanti Connect Secure flaws to take over fully patched VPN appliances
October 30, 2026 (Exploited from October 3; US federal deadlines November 2 and 13, 2026)
Security firm Volexity found an attacker it tracks as UTA0576 chaining several flaws in Ivanti Connect Secure, a widely used VPN gateway, to run code and then take root control of an appliance that was fully patched at the time (version 22.8R2.4). Exploitation began on October 3, and Ivanti said it had seen limited exploitation. The chain starts with an authentication bypass and code execution flaw (CVE-2026-104935, severity 8.6) and ends with a privilege escalation to root. Help Net Security's November 2 report lists CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload) as the two that CISA has added to its exploited-vulnerabilities list, with federal deadlines of November 2 and November 13. In the case Volexity described, the attacker stole stored credentials, including domain logins, searched Active Directory for passwords and tried password guessing against accounts. Rapid7 says the attacker also looked for Windows LAPS passwords and BitLocker recovery keys. Volexity says the activity gets past Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. When the chain was disclosed in mid-October, Ivanti had fixes for two of the flaws and promised the third within weeks. Help Net Security now reports that all three are fixed. The attack was detected and disrupted, so the attacker's final goal is unknown, and neither Ivanti nor Volexity has said how many customers were hit.
Why it matters
A VPN gateway sits between the internet and the internal network, so root access gives an attacker both a foothold and stored logins. This chain worked on an appliance that was fully patched when it was attacked, and the vendor's own integrity check misses it, so patching alone does not answer the question of whether you were already breached.
What defenders can take from it
- Install the fixed Ivanti release listed in Ivanti's advisory now. US federal deadlines were November 2 and November 13.
- Then check for compromise rather than trusting the Integrity Checker Tool. Preserve memory and logs before rebooting or resetting, and use the indicators and YARA rules that Volexity published.
- Rotate credentials the appliance could reach, especially domain logins, and review who has read Windows LAPS passwords and BitLocker recovery keys from Active Directory.
- Keep the appliance's admin pages off the internet and watch for large numbers of requests to its login path.