Ivanti Connect Secure Zero-Days Exploited: Upgrade VPNs Again Now

If your organisation uses Ivanti Connect Secure to give staff remote access, the update you installed in mid-October is no longer enough. Ivanti has disclosed two more vulnerabilities that attackers used alongside an earlier flaw to break into VPN appliances and steal credentials. This article is for IT administrators, managed service providers and business owners whose remote-access setup relies on Ivanti, a product widely used by banks, telecoms, government agencies and larger companies, including in Nigeria and across Africa.

Key takeaways

• On 29 October 2026 Ivanti added two vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Connect Secure advisory and released fixes.
• Ivanti says the flaws were exploited before they were disclosed, against a limited number of customers.
• Attackers chained them with CVE-2026-104935, an authentication bypass disclosed earlier in October.
• The US Cybersecurity and Infrastructure Security Agency (CISA) added both new flaws to its Known Exploited Vulnerabilities catalog on 30 October.
• Fixed versions are 25.1.1.3 and 22.8R2.6. The October fixes (25.1.1.2 and 22.8R2.5) do not cover the new bugs.

What happened

Earlier in October, Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure that allows a remote attacker without credentials to run commands. Security firm Volexity reported that a threat group it tracks as UTA0576 began using an exploit chain against an appliance on 3 October. At that point, a fix existed for the entry bug, but the privilege-escalation part of the chain was still unpatched.

Ivanti has now closed those gaps. According to analysis published by Rapid7 on 2 November:

• CVE-2026-111357 is a missing-authentication weakness that lets a local, authenticated attacker escalate privileges. Ivanti rates it 8.8 (high), while the CVE record and Rapid7 score it 7.0 because they consider the attack more complex.
• CVE-2026-118527 involves predictable identifiers and lets a remote, authenticated attacker upload content to a known location on the appliance’s disk. Ivanti rates it 4.3.

On its own, each bug looks limited. Combined with the earlier authentication bypass, they gave attackers deep control of the device.

What attackers did after getting in

Volexity observed credential theft and queries against Active Directory for Windows LAPS passwords (the local administrator passwords that LAPS rotates on each PC) and BitLocker recovery keys. Those are the keys to the rest of a corporate network. A compromised VPN appliance is therefore not just a single broken box; it can be a stepping stone to every laptop and server it connects to.

Who is affected

• Connect Secure 25.1.1.2 and earlier: fix by upgrading to 25.1.1.3.
• Connect Secure 22.8R2.5 and earlier: fix by upgrading to 22.8R2.6.
• Ivanti lists version 25.1.3.0 and later on ISA4500, ISA6500 and ISA8500 appliances as unaffected by the two new bugs.

Ivanti recommends moving from the 22.8 branch to 25.1.1.3 or later, and applying 22.8R2.6 only if an immediate migration is not possible.

Why a clean integrity check is not enough

Ivanti appliances include an Integrity Checker Tool that administrators often run after an incident. Volexity says this activity evades that tool, so a clean result does not prove that your appliance was not compromised. Rapid7’s guidance is to patch on an emergency basis and then actively investigate.

Signs to hunt for

Rapid7 and Volexity have shared indicators that experienced administrators or an incident-response partner can look for, including:

• Unusual requests to /dana-na/auth/url_default/welcome.cgi, particularly involving mismatched X-DSCGI-PATH headers.
• Unexpected files in temporary and log directories on the appliance, and signs that entries in the audit log were selectively deleted.
• Connections to infrastructure linked to UTA0576, published in Volexity’s and Rapid7’s write-ups.

Where possible, preserve memory and logs before rebooting or resetting the appliance, because a restart can destroy evidence.

Context for African organisations

VPN gateways and other edge devices have become a favourite target because they sit on the internet, hold credentials and are often patched more slowly than PCs. Many Nigerian and African organisations depend on a single remote-access gateway for branch offices and remote staff, and some rely on an outsourced provider to maintain it. If that describes you, do not assume your provider has applied the second round of fixes: ask for the installed version number in writing.

Regulated sectors, such as banking and payments, should also consider whether a suspected compromise needs to be reported to their regulator and to ngCERT under their incident-reporting obligations.

What you should do

1. Find every Connect Secure appliance, including test, backup and disaster-recovery units.
2. Check the version and upgrade to 25.1.1.3 or later (or 22.8R2.6 if you must stay on 22.8) outside your normal change window.
3. Investigate after patching. Review logs from early October onward and search for the published indicators. Do not rely solely on the Integrity Checker Tool.
4. If you suspect compromise, follow Ivanti’s recovery guidance, rebuild the appliance, and rotate credentials that passed through or were reachable from it, including VPN user passwords, service accounts, LAPS passwords and BitLocker recovery keys.
5. Tighten access: restrict the admin interface to management networks only and require multi-factor authentication for VPN users.
6. Get help if needed. If you lack in-house skills, engage an incident-response provider rather than guessing.

Sources

• Additional Ivanti Connect Secure zero-days exploited in the wild (Rapid7)
• CISA Known Exploited Vulnerabilities Catalog

Featured image: Photo: “Network cables” by nzhamstar, CC BY-SA 2.0, via Openverse — source