Ivanti Connect Secure: CVE-2026-104935, CVE-2026-118527 and CVE-2026-111357

Ivanti Connect Secure 25.1.1.3 and 22.8R2.6 fix the last two flaws in a chain Ivanti says was exploited against a limited number of customers. Appliances updated only to 25.1.1.2 or 22.8R2.5 remain affected.

Reviewed 1 Nov 2026 · Written by Rising from the linked sources. This is a dated snapshot, so check the official records before acting.

What the three flaws are

CVE-2026-104935 is an authentication bypass by spoofing. Ivanti says it could allow a remote unauthenticated attacker to execute arbitrary commands, and scores it 8.6 High. It is the only one of the three that Ivanti describes as reachable without authentication.

CVE-2026-118527 is a use of predictable filenames. Ivanti says it could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, and scores it 4.3 Medium.

CVE-2026-111357 is missing authentication for a critical function. Ivanti says it could allow a local authenticated attacker to escalate privileges, and scores it 8.8 High. MITRE, which published the CVE record, scores it 7.0 High: it rates attack complexity high and scope unchanged, where Ivanti rates complexity low and scope changed. MITRE's record names CWE-829 and only version 22.8R2.4, while Ivanti and CISA's catalog name CWE-306, CWE-862 and CWE-345.

On 1 November 2026, CVE-2026-118527 had no public CVE record. MITRE's CVE service reported that no record exists and NVD's API returned no results, so the NVD link for it had nothing to show on that date. Ivanti's advisory and CISA's catalog entry are the official descriptions.

FIRST's exploit prediction scores, dated 31 October, are 0.868 for CVE-2026-104935 and 0.005 for CVE-2026-111357. FIRST returned no score for CVE-2026-118527.

How the chain fits together

CISA's catalog says CVE-2026-118527 and CVE-2026-111357 can each be chained with the other two. Its alert says the set allows remote, unauthenticated execution of arbitrary commands.

Volexity, the firm Ivanti credits, describes three steps. They are an authentication bypass in how the appliance routes requests to CGI scripts, a file write flaw in an upload handler, and a privilege escalation to root through the dsinvoked broker. It says Ivanti tracks the bypass and the code execution together under CVE-2026-104935. A dated update to its post assigns the escalation to CVE-2026-111357.

Volexity's post never mentions CVE-2026-118527, and its update says the rest of the text was not revised. Ivanti does not say which step that CVE covers either. Ostorlab, which sells security testing, places it at the predictable location where the upload lands.

Ivanti's FAQ, unchanged on this point since 13 October, says its product security program found part of the vulnerability and fixed it in the July release 25.1.3.0. It says a backport was under way when exploitation occurred. Its explanation for the split disclosure is that a CVE-2026-104935 fix was already in testing, and it shipped that fix without waiting for one to the privilege escalation. The fixes for the other two followed on 29 October, 16 days after the 13 October advisory.

Affected and fixed versions

Ivanti's advisory, last modified on 29 October, lists Connect Secure 25.1.1.2 and prior and 22.8R2.5 and prior as affected by CVE-2026-118527 and CVE-2026-111357. The fixes are 25.1.1.3 and 22.8R2.6, and Ivanti says each resolves all the flaws in the advisory. 25.1.1.2 and 22.8R2.5 are the releases that fixed CVE-2026-104935, so an appliance updated for that flaw and left there still has the other two.

For CVE-2026-104935, Ivanti lists 25.1.1.1 and prior, 25.1.2.2 and prior and 22.8R2.4 and prior as affected. The resolved versions are 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5. Its 13 October text says 25.1.1.2 was released on 5 October and 22.8R2.5 on 12 October.

Ivanti's table for the two later CVEs does not name the 25.1.2 line, and NVD's range for CVE-2026-111357 omits it too. CISA's alert gives 25.1.2.2 and prior in one list covering all three CVEs. The Canadian Centre for Cyber Security lists versions before 25.1.3.1 without assigning them to a CVE. Ivanti has not said whether 25.1.2 carries the later flaws.

Ivanti says 22.7.X and lower, and 25.1.3.0 or later, do not contain this vulnerability. Both sentences use the singular and name no CVE, although the advisory covers three. Its tables name only Connect Secure. Ivanti says 22.7 and 22.8 reach end of life on 31 January 2027, and calls 22.8 a temporary bridge to 25.1.

BleepingComputer reported on 13 October that Shadowserver tracked over 5,500 Connect Secure instances exposed online, and on 14 October over 5,600 hosts with its fingerprints. The reports give no split between honeypots, secured hosts and vulnerable ones. Both counts predate the 29 October fixes.

Exploitation so far

Ivanti says it is aware of exploitation in the wild affecting a limited number of customers at the time of disclosure, when the three CVEs are chained. It gives no count. CISA says attackers are exploiting them for credential theft and data exfiltration. It added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on 13 October and the other two on 30 October, and lists ransomware use as unknown for all three.

Volexity reports one confirmed compromise in detail. Starting on 3 October, an actor it tracks as UTA0576 repeatedly exploited a customer's 22.8R2.4 appliance, which was fully patched at the time. Volexity began investigating on 5 October.

Volexity says the actor took credentials stored on the appliance and exfiltrated limited Active Directory metadata. Through a compromised service account, it searched Active Directory for LAPS passwords and BitLocker recovery keys. It also tried password spraying and parsed LDAP packet captures. Volexity found no backdoor or web shell, and the actor re-ran the whole chain for each command. Volexity assesses with low confidence that the motive is criminal rather than espionage. It assesses with medium confidence that the actor uses large language models for exploit development and post-exploitation, and with high confidence that its actions signalled preparation for lateral movement. Because the operation was disrupted, Volexity could not determine its end goal. It names no country.

BleepingComputer reports that Defused, a threat intelligence company, saw the first signs of CVE-2026-104935 exploitation on 1 October. Ostorlab describes these as attempts against Defused's decoys. Previdian, which sells exploitation data, counted 212 attempts from 95 IP addresses in 16 countries on CVE-2026-104935 between 14 October and 1 November, and says its confidence label does not mean an attempt succeeded. It also records public scanner or proof-of-concept coverage through Nuclei Templates on 14 October.

Detection and the limits of the Integrity Checker Tool

A clean result from Ivanti's Integrity Checker Tool does not clear an appliance, on CISA's and Volexity's accounts. Ivanti's 29 October advisory says limited indicators of compromise are available, points to Volexity's, and tells customers to run the tool regularly. That text states no limit on the tool.

CISA's alert, revised on 30 October, says the tool may not detect evidence of CVE-2026-104935 exploitation because the attacker's commands execute in memory. It says finding out whether an appliance was compromised takes network and memory forensics.

Volexity is firmer about the case it investigated: the chain changes a library only in memory and puts the configuration store back as it was, so the tool finds nothing. Its recommendations use softer wording, that the tool may not be able to identify compromise. Volexity sells memory forensics products.

Volexity says the payloads it recovered selectively remove entries from the Ivanti debug log and the Linux audit log, and that how far each step succeeded on the appliance is not fully established. Ostorlab says standard appliance access logs may not retain the request detail needed to search for the chain.

Volexity recommends watching for unusually many requests to the login page and for mismatches between the requested path and the routing header. It also recommends checking the /tmp directory for post-exploitation files, and running network and memory forensics if compromise is suspected. Its post has the specifics and links its indicators.

What to do

Check the version on every node. Ivanti recommends 25.1.1.3 or later, and 22.8R2.6 for 22.8 customers who cannot move immediately. Its release notes list 25.1.1.3 as build 26869 and mention a security enhancement without naming a CVE. The advisory lists no workaround.

Ivanti's upgrade notes, updated on 28 October, list tested paths to 25.1.1.3 from 25.1.1.2, and from 22.8R2.5 or 22.8R2.6 on ISA6000 or ISA8000 hardware and VMware only. They do not list 25.1.1.1, although the advisory tells those customers to go to 25.1.1.3. Cluster upgrades from 22.8Rx to 25.x are not supported. Moving to 25.1.3.0 requires ISA4500, ISA6500 or ISA8500 hardware, and virtual or cloud devices must be built from its template.

CISA's forensic triage guidance for federal agencies puts volatile data collection first. It says memory contents are lost at power-off, systems should not be altered before collection when possible, and patching comes after evidence collection because it may make artifacts unavailable. CISA's Ivanti alert urges immediate updating, and its recovery list does not mention evidence collection.

If compromise is suspected, CISA lists steps from Ivanti's recovery procedures. Back up the configuration, then factory reset and upgrade to the latest version, or rebuild cloud and virtual instances and upgrade. Restore the configuration from that backup. Credential steps follow: reset passwords for all accounts, including domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials. Ciphers Security also advises rotating the appliance's LDAP service account and considering rotation of LAPS passwords and BitLocker keys that account could read.

CISA's catalog set due dates for US federal civilian agencies of 16 October for CVE-2026-104935 and 2 November for CVE-2026-111357, both marked for forensic triage, an assessment of whether the system was compromised. CVE-2026-118527 is due on 13 November and is not marked. CISA says BOD 26-04 applies only to those agencies and encourages other organizations to prioritize catalog entries.

What is not known

How many organizations were compromised, and in which sectors, is not public. Ivanti has not said whether any exploited appliance was already on 25.1.1.2 or 22.8R2.5. The catalog lists all three CVEs as exploited, but the reports describe the later two only within the chain.

Previdian's Nuclei entry does not establish whether that template only detects the flaw or exploits it, or whether a public exploit exists for the full chain. When a CVE-2026-118527 record will be published is unknown.

Settings