CVE-2026-111357: The Ivanti Connect Secure Exploit Chain Behind Root-Level VPN Takeovers in 2026

If you run Ivanti Connect Secure (ICS), the October 13 patch was not the end of the story. CVE-2026-111357, a privilege escalation flaw, was chained with an authentication bypass and a file-upload weakness to give attackers unauthenticated root access on VPN appliances, and CISA has confirmed exploitation. This post explains how the chain works at a defender's level, what is confirmed and what is not, and how to patch, hunt, and recover.

TL;DR

• CVE ID: CVE-2026-111357 (privilege escalation), chained with CVE-2026-104935 (authentication bypass and RCE) and CVE-2026-118527 (file upload to a predictable location)
• Severity: CVE-2026-111357 is rated CVSS 8.8 by Ivanti and 7.0 in the MITRE CVE record, per Rapid7. The entry point, CVE-2026-104935, is rated 8.6
• Affected (for the two newer CVEs): ICS 22.8R2.5 and prior, and 25.1.1.2 and prior
• Fixed in: 22.8R2.6 and 25.1.1.3 (released October 29, 2026)
• Exploit status: Confirmed exploited in the wild; both newer CVEs added to CISA KEV on October 30, 2026. Public PoC and EPSS values were not stated in the sources I reviewed
• Immediate action: Upgrade, then investigate for compromise. A clean Integrity Checker result does not prove the appliance is safe

Why CVE-2026-111357 Matters in 2026

A VPN gateway sits on the boundary between the internet and your internal network. It stores directory credentials, terminates user sessions, and often talks to Active Directory. When I review a CVE like this, the question I ask is not "what is the score?" but "what is this device trusted with?" An ICS appliance is trusted with a lot.

The timeline shows why this one deserves attention. Volexity found a previously unknown actor it tracks as UTA0576 abusing a zero-day chain against a fully patched ICS appliance running 22.8R2.4 in the first week of October. Ivanti shipped a fix for the entry point on October 13. The privilege escalation stayed unpatched on the 22.8R2 line for about 16 days, until October 29, according to Ostorlab. CISA added the two newer CVEs to its KEV catalog the next day.

So many teams patched on October 13 and considered it done. That gap is the practical lesson: the first fix only closed the front door of the chain.

What the Vulnerability Actually Is

There are three weaknesses, and they matter in combination.

• CVE-2026-104935 is an authentication bypass by spoofing (CWE-290) that leads to remote command execution without credentials, per the Ivanti advisory.
• CVE-2026-118527 is a predictable-identifier weakness (CWE-340) that lets an authenticated attacker place content in a known location on disk.
• CVE-2026-111357 is a missing authentication check on a critical function (CWE-306) that lets a local, authenticated attacker escalate privileges, as summarized by Help Net Security.

On its own, CVE-2026-111357 looks modest because the attacker already needs a foothold. That is why the CVSS number is a poor guide here. Chained behind an unauthenticated entry point, a "local" bug becomes root on an internet-facing device.

I am deliberately not describing request formats or internal paths beyond what defenders need. The exploit internals are not something this post should hand out.

How the Attack Chain Works

flowchart TD
    A[ICS VPN appliance with web interface reachable from the internet] --> B[Public login page and CGI handling]
    B --> C[Condition: version at or below 22.8R2.5 or 25.1.1.2]
    C --> D[Auth bypass and command execution CVE-2026-104935]
    D --> E[Privilege escalation to root CVE-2026-111357 with file placement CVE-2026-118527]
    E --> F[Credential theft and Active Directory reconnaissance from the appliance]
    F --> G[Preparation for lateral movement into the internal network]
    G --> H[Business impact: credential exposure, domain compromise risk, forensic and rebuild cost]

Two details from Volexity change how defenders should think about this. First, the actor deployed no malware or web shell and re-ran the exploit for every command, so there is no obvious implant to find. Second, the actor tampered with logs and evaded Ivanti's Integrity Checker Tool, so common "scan for changed files" checks come up clean.

Attack Prerequisites and Realistic Impact

Confirmed

• Exploitation in the wild: both newer CVEs are in CISA KEV as of October 30, 2026. Federal deadlines were November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527, per Help Net Security.
• Post-exploitation: Volexity reported credential extraction, Active Directory queries for Windows LAPS passwords and BitLocker recovery keys, password spraying, and capture of LDAP traffic.
• Exposure: BleepingComputer cites Shadowserver tracking over 5,000 internet-exposed ICS instances, with no data on how many were secured.

Reported

• Volexity assessed with low confidence that the actor was criminal rather than espionage-driven, and Ostorlab reports a medium-confidence assessment that large language models helped develop the chain.
• Defused Cyber recorded pre-disclosure attempts from October 1, per Ostorlab.

Assessed, not proven

• Volexity assessed with high confidence that the activity signaled preparation for lateral movement, but the operation was disrupted, so the ultimate objective is unknown. I would not tell leadership that lateral movement happened. I would tell them that it was the clear next step.

Not stated in the sources I reviewed

• A public proof of concept, an EPSS value, and the number of successful compromises. Check the live FIRST EPSS value yourself.

Realistic impact: stolen directory credentials are the biggest risk. An attacker with a service account and LAPS or BitLocker secrets is well placed for the next stage, whether that is ransomware or data theft. That is an inference from the observed behavior, not a confirmed outcome.

What Researchers Are Saying in 2026

• Volexity documented the chain and warned that "forensics and network analysis are required to confirm device compromise" (Volexity).
• Rapid7 recommends applying updates on an emergency basis outside normal patching cycles, preserving memory and logs before rebooting, and rotating potentially exposed credentials (Rapid7).
• Ostorlab points out that Ivanti lists no workaround, because the entry point is the public login page a VPN has to expose (Ostorlab).
• Ivanti explained that a fix for the entry point was already in QA when the privilege escalation was found, so it chose not to delay shipping it (BleepingComputer).
• CISA updated its alert to include the new CVEs and revised the affected versions (CISA).

My read: the vendor's choice is defensible, but it left customers in a half-patched state for over two weeks. Expect that pattern again with chained bugs.

Who Is Most at Risk?

• Internet-facing ICS appliances on 22.8R2.5 and prior or 25.1.1.2 and prior. Ostorlab notes that 25.1.2.2 and prior are affected by CVE-2026-104935 specifically.
• Teams that patched only on October 13, who may believe they are current.
• Organizations whose appliance holds an Active Directory service account with broad read rights, since that is what the actor used.
• Anyone on the 22.8R2 line, which reaches end of life on January 31, 2027.

The same exposure logic applies to other edge gear: firewalls, SSL VPNs, management panels, file-transfer tools, and CI/CD or source-control servers that face the internet. They run complex parsers, hold secrets, and often lack endpoint security.

Detection: How to Tell If You Are Targeted

Detection here is hard by design, so combine several weak signals.

Network and web telemetry

• Large numbers of requests to the ICS login CGI endpoint (/dana-na/auth/url_default/welcome.cgi) from one source.
• Requests where the URL path does not match an internal routing header (X-DSCGI-PATH). Volexity cautions this covers only known entry paths. Standard appliance logs may not retain that header, so you may need proxy or packet captures.

Appliance evidence (for incident responders)

• Unexpected scripts or JSON output files in /tmp/, and an unexpected hidden capture directory under /data/, as listed by Volexity and Rapid7.
• Evidence of selective deletion in the debug and audit logs. A clean log is not proof of a clean device.

Identity and network signals from elsewhere in your environment

• Directory queries from the VPN service account for LAPS or BitLocker attributes.
• Authentication failures sprayed across many accounts, originating from the appliance's IP.
• Unexpected DNS lookups or LDAP traffic from the appliance itself.

SIEM logic (conceptual)

source = ICS service account
  AND (query attributes include LAPS password OR BitLocker recovery info)
  -> high-severity alert

source_ip = ICS appliance
  AND (auth failures across more than N accounts within 10 minutes)
  -> alert

web/proxy logs: more than N requests to the ICS login CGI from one IP within 5 minutes
  OR URL/header path mismatch where the header is logged
  -> investigate

Network indicator: Volexity listed one operation IP, 108.165.147[.]64, plus other addresses in its published indicators. Treat IPs as short-lived evidence, not a complete filter.

Important caveat: Ivanti's Integrity Checker Tool does not detect this activity, because the exploit patches code in memory and restores the configuration store. Confirming compromise needs memory and network forensics.

Immediate Remediation Plan

1. Patch. Upgrade to 22.8R2.6 or later on the 22.8R2 line, or 25.1.1.3 or later on the 25.1.1 line. For 25.1.2 and 25.1.3, follow Ivanti's upgrade guide. Ivanti recommends moving to the 25.x line.
2. Preserve evidence first if you suspect compromise. Capture memory, disk, and network data before a reboot or reset.
3. Investigate after patching. Patching does not remove an attacker who already got in.
4. Recover if needed. Back up the configuration, factory reset or rebuild, upgrade, restore, then reset every password, stored certificate, API key, and license credential, per Ostorlab.
5. Rotate directory secrets. Reset the appliance's Active Directory service account, and consider rotating LAPS and BitLocker secrets that were queryable from it.

What usually goes wrong: teams patch the primary but forget the HA peer or a lab unit, or they upgrade and then reset nothing. The second mistake is the costly one.

flowchart TD
    A[Asset discovery: find every ICS appliance including HA peers and test units] --> B[Exposure check: version, build, and internet reachability]
    B --> C[Patch deployment: 22.8R2.6 or 25.1.1.3 or later]
    C --> D[Mitigation: restrict management access, limit service account rights]
    D --> E[Log detection: login CGI bursts, directory queries from the VPN account]
    E --> F[Validation: memory and network forensics, credential rotation]
    F --> G[Continuous monitoring: KEV updates, vendor advisories, external scans]

Hardening Checklist for Security Teams

• Keep an inventory of every VPN and edge appliance, including version and build number.
• Subscribe to vendor advisories and CISA KEV updates, and treat an advisory update as a new patch event.
• Restrict the web administration interface to a management network or VPN-only path.
• Give the appliance's directory service account the least privilege it needs, and block it from reading LAPS and BitLocker attributes.
• Send appliance logs off-box in real time so local log tampering does not erase the trail.
• Capture HTTP headers at a proxy or sensor in front of the appliance where feasible.
• Alert on authentication or directory activity originating from the appliance itself.
• Pre-write a recovery runbook: evidence capture, rebuild, credential rotation, and sign-off.
• Plan the migration off any line that is nearing end of life.
• Test your restore process before you need it.

Lessons for Engineering Teams

Chained bugs break severity triage. A medium or "local" flaw can be the final step of a root compromise. Score chains, not individual CVEs.

Missing authorization checks are still common. CWE-306 and CWE-862 mean a sensitive function trusted its caller. Every privileged function should verify authorization itself, not assume an earlier layer did.

Predictable identifiers help attackers. If an upload path or token can be guessed, it should not be treated as secret.

Integrity tools have blind spots. File-based checks do not see in-memory changes. Pair them with runtime and network telemetry.

Plan for the half-patched window. If a vendor can only ship part of a fix, have an interim exposure-reduction plan ready.

FAQ

What is CVE-2026-111357?

It is a missing-authentication privilege escalation flaw in Ivanti Connect Secure that was used with two other vulnerabilities in a zero-day chain (Help Net Security).

Is CVE-2026-111357 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on October 30, 2026 (Rapid7).

Which Ivanti Connect Secure versions are affected?

For CVE-2026-111357 and CVE-2026-118527: 22.8R2.5 and prior, and 25.1.1.2 and prior. The fixes are 22.8R2.6 and 25.1.1.3.

Is the October 13 patch enough?

No. The October 13 fixes closed CVE-2026-104935 but do not remediate the two newer CVEs, according to Rapid7.

Does the Integrity Checker Tool detect exploitation?

No. Volexity reports the activity evades it, so a clean result does not rule out compromise.

Is there a workaround?

Ivanti lists none, per Ostorlab. Upgrade, and reduce exposure of management interfaces where you can.

What should I do if I think an appliance was compromised?

Preserve memory and logs, patch, rebuild or factory reset, and rotate all credentials that touched the appliance, including directory service accounts.

Conclusion

CVE-2026-111357 is a reminder that a patched edge device is not necessarily a safe one. Your next action today: confirm every ICS appliance is on 22.8R2.6, 25.1.1.3, or newer, and for any that were exposed and unpatched after early October, run the investigation and credential rotation steps above. As of the latest available public reporting, that is the safest course.

#Ivanti #IvantiConnectSecure #CVE2026111357 #CVE2026104935 #CVE2026118527 #CISAKEV #ZeroDay #VPNSecurity #Cybersecurity #PatchManagement #ThreatDetection #IncidentResponse #InfoSec #Volexity #Codebumble