# Ivanti Connect Secure Chain Gives Attackers Root on Fully Patched VPNs

- URL: https://usa-24.com/ivanti-connect-secure-vulnerability-root/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-06T21:01:43.541Z
- Updated: 2026-11-06T21:01:43.547Z
- Topics: Ivanti, VPN Security, Zero-Day Exploits, CISA KEV, Vulnerability Management

> Attackers are chaining three Ivanti Connect Secure flaws to reach root on fully patched VPN appliances, and CISA's second federal deadline falls on November 13.

## Key takeaways

- Attackers chain three Ivanti Connect Secure flaws, CVE-2026-104935, CVE-2026-118527 and CVE-2026-111357, to gain root on fully patched appliances.
- Volexity says the activity began on October 3, 2026, against an appliance running build 22.8R2.4.
- CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30, with federal due dates of November 2 and November 13.
- Ivanti's fixed builds are 25.1.1.3 for the 25.1.1.2 branch and 22.8R2.6 for the 22.8R2.5 branch, and Ivanti has published no workaround for the two newer flaws.
- Volexity observed attackers querying Active Directory for Windows LAPS passwords and BitLocker recovery keys, so a compromised appliance can spread into the wider network.

A three-flaw Ivanti Connect Secure vulnerability chain is giving attackers root access on VPN appliances that were already fully patched. According to [Rapid7's write-up](https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/), Volexity observed the campaign beginning on October 3, 2026, against an appliance running build 22.8R2.4. One federal deadline has already passed, and the second falls on November 13. Any U.S. company, agency or school that runs this remote-access VPN should treat the next several days as a hard deadline for action.

## How the three-flaw chain gives attackers root

The chain depends on three separate bugs, and each one does a different job. A breakdown published by Skycloak lays out the sequence. The attacker skips the login using CVE-2026-104935, an authentication bypass. Next, a script is uploaded to a predictable path using CVE-2026-118527, which carries a CVSS score of 4.3. That script runs as the low-privilege web user, and the attacker escalates to root with CVE-2026-111357. Finally, the attacker reads the domain credentials stored on the appliance.

Volexity's researchers put the result in blunt terms. As quoted in [SiteGuarding's security blog](https://www.siteguarding.com/security-blog/ivanti-connect-secure-root-chain/), the chain achieves "unauthenticated root-level code execution." That phrase matters because the attacker never needs a valid account at any step.

Each flaw alone has a narrower effect. A [WindowsForum analysis](https://windowsforum.com/news/ivanti-connect-secure-exploit-chain-upgrade-again-and-investigate-exposed-vpn-appliances.450573/) of the exploit chain notes that CVE-2026-111357 requires a local authenticated attacker, and CVE-2026-118527 requires a remote authenticated one. CVE-2026-104935 removes the login requirement, which is what turns the pair into a route in from outside the network. For defenders, the practical lesson is that a device current on one advisory can still fall to the chain.

## Which Ivanti Connect Secure builds are affected

CISA's updated alert lists three affected branches: 22.8R2.5 and earlier, 25.1.1.2 and earlier, and 25.1.2.2 and earlier. The fixed builds are 25.1.1.3 for the 25.1.1.2 branch and 22.8R2.6 for the 22.8R2.5 branch, according to Rapid7.

- 22.8R2.5 and earlier: upgrade to 22.8R2.6 or later.
- 25.1.1.2 and earlier: upgrade to 25.1.1.3 or later.
- 25.1.2.2 and earlier: the sources reviewed for this story do not name a fixed build, so confirm the correct version with Ivanti before assuming coverage.

Ivanti has published no workaround for CVE-2026-111357 or CVE-2026-118527, as [Decryption Digest](https://www.decryptiondigest.com/blog/ivanti-connect-secure-zero-day-chain-root-access) reports. That leaves the upgrade as the only fix described in the sources, which makes an accurate version inventory the first task for any administrator.

Scoring adds some confusion. Ivanti rates CVE-2026-111357 at 8.8, while MITRE's CVSS v3.1 score is 7.0. Teams should not let the lower MITRE number push the flaw down the queue. The chain is what makes the bug dangerous, because it becomes one link in a path to domain credentials.

## Why the CISA deadlines matter this month

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13. On Friday, October 30, it added CVE-2026-111357, which Ivanti rates at 8.8, and CVE-2026-118527, which carries a 4.3 score. Federal civilian agencies operate under Binding Operational Directive 22-01, which sets due dates for fixing cataloged flaws. The due date for CVE-2026-111357 was November 2, and the due date for CVE-2026-118527 is November 13.

Private companies face no such directive, but many use the catalog as a practical priority list. CISA's catalog also grew this week, with a WordPress core flaw added on November 3 and an older Apple flaw, CVE-2024-27834, added on November 4. Those are separate problems. The Ivanti entries stand apart because the flaws work together, and several analyses warn that patching one of them leaves the rest of the chain open.

CISA and the FBI have also warned that hackers are manipulating industrial refrigeration systems, which shows how the agency's alerts now span traditional IT and operational technology. The [agency's refrigeration warning](https://usa-24.com/refrigeration-cyberattack-warning-cisa-fbi/) is a separate story, but it reflects the same pressure on organizations that run connected equipment.

## What attackers can reach beyond the VPN

Ivanti said attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed, according to [SecurityWeek](https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/). The company has not published a count, and the sources reviewed do not provide one. Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its own customers. Volexity links the activity to a threat actor it tracks as UTA0576. The sources reviewed do not include a government attribution.

The stolen material is what turns this from a VPN problem into a network problem. Volexity observed credential theft and Active Directory queries aimed at Windows LAPS passwords, which store local administrator passwords, and at BitLocker recovery keys, which restore access to encrypted drives. An attacker holding those secrets can move through a network, and the appliance becomes a foothold rather than a dead end at the edge. Security teams should treat the VPN box as a possible path into the domain, not just a perimeter device.

Consumers face no direct risk from this chain. You are exposed only if your employer or school runs Ivanti Connect Secure for remote access, so the practical question is whether your IT team has acted.

## Steps IT teams should take now

1. Inventory every Ivanti Connect Secure appliance and record the exact build, including any on the 25.1.2.2 branch.
2. Upgrade to 25.1.1.3 or 22.8R2.6, or to a later build, depending on the branch. Ivanti's fixed-version list is the authority for the exact version.
3. Patch all three flaws, not just one. Several analyses warn that patching only one leaves the rest of the chain open.
4. Do not rely on Ivanti's Integrity Checker Tool to rule out compromise. Volexity reports that the observed activity evades it, so a clean result does not prove the device is safe. CISA has also warned that the attack "may not detect evidence of exploitation" because the commands run in memory.
5. Review the Volexity and Rapid7 indicators and detection guidance, and hunt for the behavior they describe.
6. If the appliance was exposed, rotate domain credentials, Windows LAPS passwords and BitLocker recovery keys. This recommendation comes from Skycloak's analysis, not from an official Ivanti statement.

## What to watch next

Watch for an official count of affected customers. Ivanti has described only a limited number, and that gap leaves administrators guessing about how widely the chain was used. Watch also whether a government body publicly attributes the campaign, since Volexity's UTA0576 link is the only attribution in the reporting so far.

Copycat activity is the bigger question. One analysis expects more actors to copy the chain now that the details are public, but the reporting does not yet show how many have. The sources also differ on whether the first flaw needs its own separate patch, so administrators should verify each fix against the vendor's advisory rather than assume one update covers everything.

Patch bypasses are not new to network gear. A zero-day [got around a June patch on Zyxel GS1900 switches](https://usa-24.com/zyxel-gs1900-zero-day-patch-bypass/), affecting nearly 1,000 devices, which is a reminder that a fix can be incomplete. The practical lesson here is simple. The upgrade closes the door, but the investigation decides whether someone already walked through it.

## Frequently asked questions

### Which Ivanti Connect Secure versions are vulnerable to the three-flaw chain?

CISA's updated alert lists 22.8R2.5 and earlier, 25.1.1.2 and earlier, and 25.1.2.2 and earlier as affected. Ivanti's fixed builds are 25.1.1.3 for the 25.1.1.2 branch and 22.8R2.6 for the 22.8R2.5 branch. The sources reviewed do not name a fixed build for the 25.1.2.2 branch, so confirm that with Ivanti before assuming you are covered.

### What is CVE-2026-111357 and how severe is it?

CVE-2026-111357 is the flaw that lets an attacker escalate to root in the chain. Ivanti rates it 8.8, while MITRE's CVSS v3.1 score is 7.0. CISA added it to its Known Exploited Vulnerabilities catalog on October 30, with a federal due date of November 2.

### Can Ivanti's Integrity Checker Tool show whether a VPN was hacked?

Not reliably. Volexity reports that the observed activity evades the tool, so a clean result does not rule out compromise. CISA has also warned that the attack may not detect evidence of exploitation because the commands run in memory. Teams should review the Volexity and Rapid7 indicators as well.

### Should we rotate credentials if our Ivanti VPN was exposed?

The Skycloak analysis recommends rotating domain credentials, Windows LAPS passwords and BitLocker recovery keys if the appliance was exposed. Volexity observed attackers querying Active Directory for those secrets. Ivanti has not made that recommendation itself, so treat it as guidance from the analysis.

## Sources

1. [Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) — Rapid7](https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/)
2. [Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain — SecurityWeek](https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/)
3. [Ivanti Connect Secure Flaws: Patch Before Nov 2 — SiteGuarding](https://www.siteguarding.com/security-blog/ivanti-connect-secure-root-chain/)
4. [CISA adds Ivanti Connect Secure vulnerabilities to known exploited catalog — SC World](https://www.scworld.com/brief/cisa-adds-ivanti-connect-secure-vulnerabilities-to-known-exploited-catalog)
5. [Ivanti Connect Secure CVE-2026-111357: Patch, Rotate, Contain — Skycloak](https://skycloak.io/blog/ivanti-connect-secure-cve-2026-111357-118527-patch-rotate-sessions/)
6. [Ivanti Connect Secure: 2 New Zero-Day CVEs, Nov 13 [2026] — Tech Insider](https://tech-insider.org/ivanti-connect-secure-cve-2026-111357-118527-kev-deadline-nov-13-2026/)
7. [Ivanti Connect Secure Zero-Day Chain: Root Access — Decryption Digest](https://www.decryptiondigest.com/blog/ivanti-connect-secure-zero-day-chain-root-access)
8. [Ivanti Connect Secure Exploit Chain: Upgrade Again and Investigate Exposed VPN Appliances — WindowsForum](https://windowsforum.com/news/ivanti-connect-secure-exploit-chain-upgrade-again-and-investigate-exposed-vpn-appliances.450573/)