Ivanti Connect Secure Zero-Days: 3 Chained Flaws Gave Hackers Root Access to VPNs – Explained Simply

The Ivanti Connect Secure zero-days are a serious warning for every company that uses a VPN. Ivanti has patched two more zero-day vulnerabilities in its Connect Secure VPN. Attackers were already using them, together with a third flaw fixed in October, to take full root control of VPN appliances without any login. Even appliances that were fully patched at the time were reportedly hit.

If you are a student preparing for a cybersecurity role, or a working professional whose company uses Ivanti VPN, this story matters. Let’s break it down in simple words.

What happened? (Quick summary) – Ivanti Connect Secure

• Product: Ivanti Connect Secure (ICS), a VPN gateway many companies use for secure remote access.
• Flaws: Three vulnerabilities were chained together – CVE-2026-104935, CVE-2026-118527 and CVE-2026-111357.
• Attacker: A previously unknown group that security firm Volexity tracks as UTA0576.
• When: The earliest exploitation seen was around 3 October 2026. Ivanti released the last two fixes on 29 October 2026.
• Impact: Ivanti says only a limited number of customers were affected, but the attackers stole credentials and data.
• Government alert: The US agency CISA added both new flaws to its Known Exploited Vulnerabilities (KEV) catalogue on 30 October 2026.

The three vulnerabilities explained – Ivanti Connect Secure

Think of it like a thief breaking into a building. One flaw opens the main gate, the second lets him drop a tool inside, and the third gives him the master key. Here is each one:

1. CVE-2026-104935 – The open gate (CVSS 8.6)

This is an authentication bypass flaw. A remote attacker who is not logged in could trick the appliance into treating their request as trusted, and then run commands. Ivanti fixed it on 13 October 2026, and CISA added it to the KEV list the same day.

2. CVE-2026-118527 – Dropping a tool inside (CVSS 4.3)

This flaw is about predictable file names or locations. Because the upload location could be guessed, the attacker could place a file with their own content on the disk and run it before the system cleaned it up. On its own the score is low, but in a chain it becomes very useful for attackers.

3. CVE-2026-111357 – The master key (CVSS 8.8)

This is a missing authentication for a critical function flaw. It allowed privilege escalation, meaning the attacker could jump from a normal process to root – the most powerful account on the device. According to reports, a root-level maintenance service trusted program paths stored in a configuration cache, and the attackers changed one entry to run their own script.

Put all three together and the result is serious: unauthenticated remote code execution as root on a VPN appliance that sits at the edge of the company network. Related reading: Arista VeloCloud zero-day under active attack.

Why was a “fully patched” VPN still hacked – Ivanti Connect Secure?

This is the most important lesson. When the attacks started in early October, the fix for the first flaw was reportedly still in testing, and the privilege-escalation flaw had no patch at all. That is the meaning of a zero-day – the vendor has had “zero days” to fix it before attackers use it.

There is one more twist. Customers who upgraded to 25.1.1.2 or 22.8R2.5 in October (to fix the first flaw) are still exposed to the two newer flaws. They need to upgrade again.

What did the attackers do after getting in – Ivanti Connect Secure?

Based on Volexity’s investigation as summarised by security researchers, the attackers:

• Pulled the appliance’s LDAP / Active Directory service account credentials.
• Ran a disguised packet-capture tool to grab passwords and login data passing through the device.
• Tested stolen passwords using Kerberos tools and password spraying.
• Searched Active Directory for sensitive items such as LAPS passwords and BitLocker recovery data (it is not confirmed they obtained them).
• Copied configuration and DNS data out of the network.
• Cleaned up their tracks – deleting payloads, removing log entries and making changes only in memory.

Interestingly, they left no web shell or backdoor. Instead they re-ran the exploit chain every time they wanted to send a command. Because of this, Ivanti’s own Integrity Checker Tool (ICT) reportedly showed a clean result, and CISA warned the tool may miss this activity. Researchers also assessed with medium confidence that the attackers reportedly used AI (large language models) to help build their exploit and tools.

Which versions are affected and which are safe – Ivanti Connect Secure?

• Affected (by the two new flaws): Connect Secure 25.1.1.2 and earlier, and 22.8R2.5 and earlier.
• Fixed versions: 25.1.1.3 and 22.8R2.6 (or later). Ivanti says these address all three chained flaws.
• Not affected by the first flaw (per Ivanti’s October advisory): 22.7.x and below – but always confirm with Ivanti’s official advisory for your exact build.

Why VPN appliances are a favourite target – Ivanti Connect Secure

VPN gateways sit on the internet 24×7 and act as the front door to a company. They usually do not run normal antivirus or EDR software, and they hold valuable things like domain credentials. If an attacker owns the VPN, they can quietly watch logins and move deeper into the network. That is why Ivanti, Fortinet, Cisco, Citrix and SonicWall edge devices keep appearing in CISA’s KEV list.

What should you do – Ivanti Connect Secure?

If your organisation uses Ivanti Connect Secure:

• Upgrade immediately to 25.1.1.3, 22.8R2.6 or later. Do not stop at 25.1.1.2 or 22.8R2.5.
• Do not trust a clean ICT scan alone. Combine it with log review, memory and network forensics.
• Hunt back to at least 1 October 2026 for unusual LDAP, Kerberos or password-spraying activity coming from the VPN appliance, missing log entries, and unexpected files or processes.
• If compromise is suspected: back up the config, factory-reset and upgrade the appliance, then restore the config (rebuild virtual or cloud instances).
• Rotate secrets: reset domain, admin and local account passwords (including the VPN’s AD service account), reissue certificates and API keys.

If you are a student or job seeker: learn how to read a vendor advisory, what CVSS scores mean, and how the CISA KEV catalogue works. These are common interview topics for SOC analyst and vulnerability-management roles.

Key takeaways

• Three Ivanti Connect Secure flaws were chained to get root access without login.
• Two of them (CVE-2026-111357 and CVE-2026-118527) were patched on 29 October 2026.
• The safe versions are 25.1.1.3 and 22.8R2.6 or later.
• The attackers hid well – a clean Integrity Checker result does not prove safety.
• Patching is not the end of the job: hunting and password rotation are equally important.

FAQ

GK Practice Questions – Ivanti Connect Secure

Multiple Choice Questions (MCQs)

Q1. Which Ivanti product was targeted in this zero-day attack chain?
(a) Ivanti Neurons
(b) Ivanti Connect Secure
(c) Ivanti EPMM
(d) Ivanti Policy Secure

Q2. How many vulnerabilities were chained together in this attack?
(a) One
(b) Two
(c) Three
(d) Five

Q3. CVE-2026-111357 mainly allowed attackers to:
(a) Crash the device
(b) Escalate privileges to root
(c) Send spam emails
(d) Change the device’s IP

Q4. Which security firm discovered and named the actor UTA0576?
(a) Mandiant
(b) Volexity
(c) Kaspersky
(d) Check Point

Q5. Which of these is a fixed (safe) version of Ivanti Connect Secure?
(a) 25.1.1.2
(b) 22.8R2.5
(c) 25.1.1.3
(d) 22.8R2.4

Q6. What does KEV stand for in the CISA catalogue?
(a) Key Encryption Vault
(b) Known Exploited Vulnerabilities
(c) Kernel Error Values
(d) Known Endpoint Viruses

Short Answer Questions

Q1. What is the CVSS score of CVE-2026-111357?

Q2. On which date did Ivanti release fixes for the two newer zero-days?

Q3. Name the Ivanti tool that reportedly failed to detect this activity.

Q4. What type of flaw is CVE-2026-118527?

Q5. When was exploitation first observed on the investigated appliance?

Descriptive Questions

Q1. Explain how chaining multiple low and high severity vulnerabilities can lead to a full system compromise, using the Ivanti Connect Secure case as an example.

Q2. Why are VPN and other edge appliances attractive targets for attackers, and what steps should organisations take after patching such a device?

Sources