A three-flaw Ivanti Connect Secure vulnerability chain is giving attackers root access on VPN appliances that were already fully patched. According to Rapid7's write-up, Volexity observed the campaign beginning on October 3, 2026, against an appliance running build 22.8R2.4. One federal deadline has already passed, and the second falls on November 13. Any U.S. company, agency or school that runs this remote-access VPN should treat the next several days as a hard deadline for action.
How the three-flaw chain gives attackers root
The chain depends on three separate bugs, and each one does a different job. A breakdown published by Skycloak lays out the sequence. The attacker skips the login using CVE-2026-104935, an authentication bypass. Next, a script is uploaded to a predictable path using CVE-2026-118527, which carries a CVSS score of 4.3. That script runs as the low-privilege web user, and the attacker escalates to root with CVE-2026-111357. Finally, the attacker reads the domain credentials stored on the appliance.
Volexity's researchers put the result in blunt terms. As quoted in SiteGuarding's security blog, the chain achieves "unauthenticated root-level code execution." That phrase matters because the attacker never needs a valid account at any step.
Each flaw alone has a narrower effect. A WindowsForum analysis of the exploit chain notes that CVE-2026-111357 requires a local authenticated attacker, and CVE-2026-118527 requires a remote authenticated one. CVE-2026-104935 removes the login requirement, which is what turns the pair into a route in from outside the network. For defenders, the practical lesson is that a device current on one advisory can still fall to the chain.
Which Ivanti Connect Secure builds are affected
CISA's updated alert lists three affected branches: 22.8R2.5 and earlier, 25.1.1.2 and earlier, and 25.1.2.2 and earlier. The fixed builds are 25.1.1.3 for the 25.1.1.2 branch and 22.8R2.6 for the 22.8R2.5 branch, according to Rapid7.
- 22.8R2.5 and earlier: upgrade to 22.8R2.6 or later.
- 25.1.1.2 and earlier: upgrade to 25.1.1.3 or later.
- 25.1.2.2 and earlier: the sources reviewed for this story do not name a fixed build, so confirm the correct version with Ivanti before assuming coverage.
Ivanti has published no workaround for CVE-2026-111357 or CVE-2026-118527, as Decryption Digest reports. That leaves the upgrade as the only fix described in the sources, which makes an accurate version inventory the first task for any administrator.
Scoring adds some confusion. Ivanti rates CVE-2026-111357 at 8.8, while MITRE's CVSS v3.1 score is 7.0. Teams should not let the lower MITRE number push the flaw down the queue. The chain is what makes the bug dangerous, because it becomes one link in a path to domain credentials.
Why the CISA deadlines matter this month
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13. On Friday, October 30, it added CVE-2026-111357, which Ivanti rates at 8.8, and CVE-2026-118527, which carries a 4.3 score. Federal civilian agencies operate under Binding Operational Directive 22-01, which sets due dates for fixing cataloged flaws. The due date for CVE-2026-111357 was November 2, and the due date for CVE-2026-118527 is November 13.
Private companies face no such directive, but many use the catalog as a practical priority list. CISA's catalog also grew this week, with a WordPress core flaw added on November 3 and an older Apple flaw, CVE-2024-27834, added on November 4. Those are separate problems. The Ivanti entries stand apart because the flaws work together, and several analyses warn that patching one of them leaves the rest of the chain open.
CISA and the FBI have also warned that hackers are manipulating industrial refrigeration systems, which shows how the agency's alerts now span traditional IT and operational technology. The agency's refrigeration warning is a separate story, but it reflects the same pressure on organizations that run connected equipment.
What attackers can reach beyond the VPN
Ivanti said attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed, according to SecurityWeek. The company has not published a count, and the sources reviewed do not provide one. Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its own customers. Volexity links the activity to a threat actor it tracks as UTA0576. The sources reviewed do not include a government attribution.
The stolen material is what turns this from a VPN problem into a network problem. Volexity observed credential theft and Active Directory queries aimed at Windows LAPS passwords, which store local administrator passwords, and at BitLocker recovery keys, which restore access to encrypted drives. An attacker holding those secrets can move through a network, and the appliance becomes a foothold rather than a dead end at the edge. Security teams should treat the VPN box as a possible path into the domain, not just a perimeter device.
Consumers face no direct risk from this chain. You are exposed only if your employer or school runs Ivanti Connect Secure for remote access, so the practical question is whether your IT team has acted.
Steps IT teams should take now
- Inventory every Ivanti Connect Secure appliance and record the exact build, including any on the 25.1.2.2 branch.
- Upgrade to 25.1.1.3 or 22.8R2.6, or to a later build, depending on the branch. Ivanti's fixed-version list is the authority for the exact version.
- Patch all three flaws, not just one. Several analyses warn that patching only one leaves the rest of the chain open.
- Do not rely on Ivanti's Integrity Checker Tool to rule out compromise. Volexity reports that the observed activity evades it, so a clean result does not prove the device is safe. CISA has also warned that the attack "may not detect evidence of exploitation" because the commands run in memory.
- Review the Volexity and Rapid7 indicators and detection guidance, and hunt for the behavior they describe.
- If the appliance was exposed, rotate domain credentials, Windows LAPS passwords and BitLocker recovery keys. This recommendation comes from Skycloak's analysis, not from an official Ivanti statement.
What to watch next
Watch for an official count of affected customers. Ivanti has described only a limited number, and that gap leaves administrators guessing about how widely the chain was used. Watch also whether a government body publicly attributes the campaign, since Volexity's UTA0576 link is the only attribution in the reporting so far.
Copycat activity is the bigger question. One analysis expects more actors to copy the chain now that the details are public, but the reporting does not yet show how many have. The sources also differ on whether the first flaw needs its own separate patch, so administrators should verify each fix against the vendor's advisory rather than assume one update covers everything.
Patch bypasses are not new to network gear. A zero-day got around a June patch on Zyxel GS1900 switches, affecting nearly 1,000 devices, which is a reminder that a fix can be incomplete. The practical lesson here is simple. The upgrade closes the door, but the investigation decides whether someone already walked through it.
