All Three Links Now Patched: How the Ivanti Connect Secure Attack Chain Went From Zero-Day to Full Fix, and What the Attackers Were After
CISA has added two more Ivanti Connect Secure flaws to its exploited list, completing the three-bug chain that let an unknown group reach root on VPN gateways without logging in. Fixes for every link are now out. Here is the timeline and what to do.
Earlier this month, Ivanti Connect Secure customers learned that attackers had a way into their VPN gateways that needed no password. At the time, only part of the problem could be fixed. As of this week, every link in that chain has a patch, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the last two pieces are being exploited too.
The details below come from The Hacker News’ report on the completed Ivanti exploit chain.
How the story unfolded
- July: Ivanti says it found part of one of the bugs through its own product security program and fixed it in release 25.1.3.0. It was still working on bringing that fix to other supported versions when attacks began.
- Early October: security firm Volexity documents a previously unknown threat actor, which it calls UTA0576, chaining three Connect Secure flaws to run code as root without authenticating.
- October 13: CISA adds the first link, the authentication bypass CVE-2026-104935, to its Known Exploited Vulnerabilities catalog. Ivanti had already been testing a fix for it and chose to ship that first rather than wait for the privilege escalation fix.
- October 30: CISA adds the remaining two flaws, CVE-2026-111357 and CVE-2026-118527, to the catalog. Ivanti’s latest releases now address every vulnerability in the chain.
The three links
- Getting in: CVE-2026-104935, an authentication bypass rated 8.6.
- Running code: CVE-2026-118527, rated 4.3. It stems from predictable identifiers and lets an authenticated attacker upload files with content they control to a known location on disk. On its own the score looks modest; paired with the bypass, it becomes a route to code execution.
- Becoming root: CVE-2026-111357, rated 8.8, a missing authentication check on a critical function that lets a local authenticated attacker raise their privileges.
Volexity summed the combination up as an authentication bypass, remote code execution and privilege escalation working together to reach unauthenticated root-level code execution.
What the attackers went after
Many gateway attacks end with a web shell or malware left behind. Volexity reported that this group behaved differently. It used its access to pull out credentials and limited Active Directory information, look around the host, and search for administrator passwords and BitLocker recovery keys. In other words, the gateway was a doorway to the rest of the network, not the end goal.
Fixed versions
- Connect Secure 25.1.1.2 and earlier: update to 25.1.1.3.
- Connect Secure 22.8R2.5 and earlier: update to 22.8R2.6.
U.S. federal civilian agencies must patch CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13.
What this means for your company
A remote access gateway sits on the internet by design, which makes it one of the first things attackers probe. If you run Ivanti Connect Secure, apply the latest release now, even if you patched the authentication bypass two weeks ago. Because this group was hunting for credentials, administrator passwords and disk recovery keys, a patch alone may not be enough if your gateway was exposed earlier this month: consider rotating credentials that touched the device, reviewing where BitLocker recovery keys are stored, and checking for unusual sign-ins. Whatever VPN you use, know who watches its advisories and how fast updates go in.
Want a second set of eyes on your VPN gateway, its patch level and what an attacker could reach from it? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
