Ivanti Connect Secure Exploit Chain Reaches CISA's KEV List: What VPN Admins Should Do Now

Ivanti Connect Secure is a widely deployed VPN gateway, so any exploit chain that reaches root on it exposes credentials and internal networks. This brief is for IT security teams, MSPs and SaaS buyers who depend on remote access appliances.

What happened

CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog on October 30, 2026, citing evidence of active exploitation, according to its official alert. CISA describes the first as missing authentication in a critical function and the second as predictable identifiers.

• CVE-2026-111357 (CVSS 8.8): local privilege escalation by an authenticated attacker.
• CVE-2026-118527 (CVSS 4.3): a remote authenticated attacker can upload files to a known location on disk.
• CVE-2026-104935 (CVSS 8.6): the authentication bypass that opens the chain, added to the catalog on October 13, 2026.

Volexity first documented the chain on October 13, 2026 and attributes it to a previously undocumented actor it tracks as UTA0576, as Help Net Security reported on October 14. The Hacker News reported on October 31 that the three flaws together give unauthenticated root-level code execution.

Why it matters

A VPN gateway sits at the network edge and holds credentials, so root access there is close to a full compromise. Help Net Security reported that the attacker stole credentials, collected Active Directory metadata, and gathered local administrator passwords and BitLocker recovery keys.

The attacker did not rely on a persistent web shell. Because the exploit alters library code in memory, Ivanti's Integrity Checker Tool may not detect it, so a clean scan is not proof of safety.

What it means for B2B SaaS buyers and IT teams

Treat remote access appliances as high-risk assets with their own patch deadline and incident plan. Any SaaS or MSP that uses Connect Secure to reach customer networks or admin consoles should assume stolen credentials could reach those systems.

• Patch status matters per branch: The Hacker News lists fixes in 25.1.1.3 and 22.8R2.6 for the two new flaws.
• Federal civilian agencies face a November 2 deadline for CVE-2026-111357 and November 13 for CVE-2026-118527, according to the same report.
• Vendors that use Ivanti VPNs should be asked in security reviews whether they have patched and investigated.

What to do now

Patch first, then investigate. Upgrade every Connect Secure appliance to a fixed release and assume that exposed or previously vulnerable appliances may already be compromised until you have checked.

• Upgrade to Ivanti Connect Secure 25.1.1.3 or 22.8R2.6, or the latest release for your branch.
• Review Volexity's published indicators of compromise and check logs for unusual authentication and file writes.
• Do not rely on the Integrity Checker Tool alone; capture memory and network evidence if you suspect compromise.
• Rotate credentials, local administrator passwords and BitLocker recovery keys that could have been exposed.
• Restrict management interfaces and require MFA for all VPN accounts.

Follow Ivanti advisories for current fixed versions, since version details can change.

Related SaaSPodium resources

Use the SaaSPodium directory to review the tools around this incident, from remote access and VPN products to scanners that find exposed appliances. Compare options in the VPN software and vulnerability management software categories, and read the guide to vulnerability management tools. For remote access alternatives, browse remote access software.

Facts are based on CISA, Help Net Security and The Hacker News as of October 31, 2026, and may be updated by the vendor.

Frequently Asked Questions

Which Ivanti Connect Secure versions fix the newly exploited flaws?
According to The Hacker News, 25.1.1.2 and earlier are fixed in 25.1.1.3, and 22.8R2.5 and earlier are fixed in 22.8R2.6. Confirm in Ivanti's advisory and move to the latest release for your branch.

Can the Integrity Checker Tool confirm my appliance is clean?
Not reliably. Help Net Security reported that the exploit changes library code in memory, so the tool may miss it. Use Volexity's indicators, log review and forensic investigation if you suspect compromise.

Should we replace our VPN after this incident?
Not automatically. Patch and investigate first, then review whether the product meets your risk needs. Compare VPN, zero trust and remote access options by security track record, patch cadence and architecture before deciding.