If you patched Ivanti Connect Secure earlier this month and moved on, I have bad news for your weekend. The October 13 fix only closed the front door of a three-bug chain. On October 30, CISA added the other two pieces to its Known Exploited Vulnerabilities catalog, and the federal deadline for the worst one is Monday, November 2.
The Chain
Volexity documented this back on October 13, after catching an actor it calls UTA0576 exploiting a customer's appliance starting October 3. Now all three CVEs have names and patches:
- CVE-2026-104935 (auth bypass, CVSS 8.6): a request to a public login page carries a header that quietly routes it to a protected script. The URL gets checked. The header decides where it actually goes. In KEV since October 13.
- CVE-2026-118527 (CVSS 4.3): predictable identifiers that let an attacker drop files in a known spot on disk. Don't let the low score fool you, it's a link in a chain that ends at root. KEV deadline November 13.
- CVE-2026-111357 (CVSS 8.8): missing authentication on a critical function, used to escalate to root. Ivanti released this fix on October 29. KEV deadline November 2.
Ivanti says it is aware of exploitation affecting "a limited number of customers" and that it shipped the auth bypass fix first rather than wait for the whole set. That was a reasonable call. It also means the October patch was never the finish line.
What the Attacker Did
This is the part I'd read twice. Per Volexity, UTA0576 didn't drop a web shell or malware. It ran everything in memory, patched a library in memory to get root, then put things back and cleaned the logs. Then it went after the good stuff: stored LDAP credentials, LAPS admin passwords, BitLocker recovery keys, and plaintext credentials sniffed off LDAP traffic with a renamed tcpdump. Volexity says with high confidence this was setup for lateral movement, and that Ivanti's Integrity Checker Tool didn't detect it.
So "the integrity check came back clean" is not an all-clear.
The Bigger Point
The VPN concentrator keeps showing up in these stories for a reason. It sits on the internet, it holds directory credentials, and it's trusted by everything behind it. Owning it isn't the goal. It's the launch pad. Every vendor ships bugs, Zscaler included (and yes, I work at Zscaler, so weigh my architecture opinions accordingly). But an access model where users connect to apps, not to the network, and where there's no listening login page for the internet to poke at, takes this whole class of launch pad off the table.
What To Do
- Upgrade to 25.1.1.3 or 22.8R2.6 (or later). Per Ivanti, the latest release fixes the full chain. If you only applied the October 13 build, you're not done.
- Assume credentials are exposed if you were vulnerable at any point since late September. Rotate the LDAP service account and anything stored on the appliance, and check whether LAPS passwords and BitLocker keys were queried.
- Hunt the logs: requests to
/dana-na/auth/url_default/welcome.cgicarrying anX-DSCGI-PATHheader, and Active Directory auth events from the appliance's IP or service account. - Do memory and network forensics, not just the Integrity Checker.
- Start the conversation about getting remote access off a public-facing appliance. Not this weekend. But soon.
Bottom Line
Three bugs, one chain, no malware left behind, and credentials walking out the door. If your Ivanti box was on the October 13 build, it needs another patch before Monday.
Sources: Volexity, The Hacker News, Ivanti advisory, and CISA alert