Daily · Article 01 · 5 min read
- Security
Ivanti VPN chain adds exploited flaws; recheck October 13 patches
October 29 additional fixes; October 30 KEV additions; October 31 recheck
Summary
CISA added two Ivanti Connect Secure flaws to its exploited-vulnerability catalog on October 30. Match the vendor’s October 29 fixes to actual appliances; earlier credential theft and data loss need separate investigation.
A VPN appliance used to reach work systems from outside can become the starting point of an intrusion. Operators of Ivanti Connect Secure should match their appliance to a fixed release and investigate earlier access alongside patching.
Key facts
On October 30, US cybersecurity agency CISA added two Ivanti Connect Secure flaws to KEV, its catalog of vulnerabilities known to have been exploited. The catalog release was October 31 at 02:02 JST. Manufacturer Ivanti added fixes to its October 29 advisory update and reported exploitation against some customers when three flaws were chained. A catalog addition is not the first attack date or first patch release. KEV feed · Vendor advisory
CISA warns of credential theft and data exfiltration. Scope concerns the affected Ivanti appliances and deployments, rather than every VPN app on a personal PC. October 30 alert update
1. What an attacker gains at the access gateway
A VPN provides a communication route for employees outside an organization to reach internal resources. Connect Secure is the organization-side appliance accepting that access. Positioned between personal computers and internal systems, a compromised appliance can provide a foothold into internal connections and authentication information.
Security investigators Volexity reported collection of configuration and account data, inspection of captured traffic and password attempts against internal accounts in the intrusion they investigated. The diagram explains that reported risk; it is not a finding that every customer suffered the same harm. Volexity investigation
%% Access-gateway compromise · simplified from the investigated attack
flowchart TD
A["Vulnerable internet-facing VPN"] --> B["Attacker runs commands on it"]
B --> C["Collect accounts, settings<br/>And communication data"]
C --> D["Try internal accounts<br/>Take data out"]The cat asks Q&A
The researcherIs my laptop infected just because it has a VPN?
Pocket NotebookThis alert concerns particular Ivanti appliances operated by organizations. Ask your operator about the product, version and investigation; the notice alone cannot establish infection of your PC. Share any unrecognized access records with your security team.
2. Linking flaws increases the attacker's authority
Authentication checks who someone is; permissions define what they can do. The investigated chain crosses an authentication boundary from outside, uses a route to place and execute attacker content, and escalates privileges inside the appliance. root is the highest administrator authority over the device.
| Flaw | Individual condition and role | Why it matters in a chain |
|---|---|---|
| CVE-2026-104935 | Remote unauthenticated attacker bypasses authentication and runs commands | Entry across the outside-to-appliance boundary |
| CVE-2026-118527 | Remote authenticated attacker uploads content to a predictable location | Places attacker-controlled content at a known path |
| CVE-2026-111357 | Local authenticated attacker escalates privileges | Expands limited access to highest administrator authority |
- Flaw
CVE-2026-104935
- Individual condition and role
- Remote unauthenticated attacker bypasses authentication and runs commands
- Why it matters in a chain
- Entry across the outside-to-appliance boundary
- Flaw
CVE-2026-118527
- Individual condition and role
- Remote authenticated attacker uploads content to a predictable location
- Why it matters in a chain
- Places attacker-controlled content at a known path
- Flaw
CVE-2026-111357
- Individual condition and role
- Local authenticated attacker escalates privileges
- Why it matters in a chain
- Expands limited access to highest administrator authority
An authentication requirement on one component does not establish that the whole chain needs a stolen password: an earlier bypass can provide the next foothold. Conversely, the last two flaws are not each standalone unauthenticated remote-execution flaws. Vendor conditions
The cat asks Q&A
- The researcher
Can someone without login details end up controlling the appliance?
Pocket NotebookIvanti reports actual exploitation chaining these three flaws. Each step helps satisfy the next condition, so a later flaw labeled local and authenticated does not prove that the complete intrusion was blocked. Whether your own appliance was compromised needs a separate investigation.
3. Recheck appliances patched on October 13
In the vendor matrix, 25.1.1.2 and 22.8R2.5 fix the first flaw, but the two added on October 29 require later fixes on those branches. Similar version numbers do not remove hardware and migration requirements.
| Current branch or state | Vendor's fixed-release path | Evidence the operator should retain |
|---|---|---|
| Affected 25.1.1 branch through 25.1.1.2 | 25.1.1.3 | Appliance model, installed build and post-update version |
| Affected 22.8 branch through 22.8R2.5 | 22.8R2.6 if migration cannot happen now; move to 25.1 recommended | Distinguish the interim patch from the later migration plan |
| First-flaw path for 25.1.2.2 and earlier | Vendor matrix lists 25.1.3.0 and 25.1.3.1 | Check new platform and virtual-template requirements |
| Supported platform running 25.1.3.0 or later | Vendor says these releases do not contain the flaw | Establish that the appliance actually runs that branch |
- Current branch or state
Affected 25.1.1 branch through 25.1.1.2
- Vendor's fixed-release path
- 25.1.1.3
- Evidence the operator should retain
- Appliance model, installed build and post-update version
- Current branch or state
Affected 22.8 branch through 22.8R2.5
- Vendor's fixed-release path
- 22.8R2.6 if migration cannot happen now; move to 25.1 recommended
- Evidence the operator should retain
- Distinguish the interim patch from the later migration plan
- Current branch or state
First-flaw path for 25.1.2.2 and earlier
- Vendor's fixed-release path
- Vendor matrix lists 25.1.3.0 and 25.1.3.1
- Evidence the operator should retain
- Check new platform and virtual-template requirements
- Current branch or state
Supported platform running 25.1.3.0 or later
- Vendor's fixed-release path
- Vendor says these releases do not contain the flaw
- Evidence the operator should retain
- Establish that the appliance actually runs that branch
25.1.3.0 was released in July for the new platform, including ISA4500, ISA6500 and ISA8500. It is not a number to install on every old appliance without checking compatibility. Ivanti says 22.7 and lower do not contain this flaw, but 22.7 and 22.8 reach end of life on January 31, 2027. Consult the vendor compatibility guide for the migration path.
The cat asks Q&A
- The researcher
Is a record that someone clicked Update enough?
Pocket NotebookRetain the actual installed version and appliance model after completion and match them to the vendor path. A scheduled or downloaded update is not proof of application. We did not access or patch any reader's appliance.
4. A patch does not erase an earlier intrusion
A patch blocks the same vulnerability from being used again. It does not erase copied credentials or retrieve stolen data. CISA calls for network and memory forensics and warns that the Integrity Checker Tool, which inspects disk changes, may miss commands executed in memory.
%% Track 1 · block future exploitation while the investigation below proceeds
flowchart TD
A["Identify model, version<br/>And external exposure"] --> B["Apply compatible fixed release"]%% Track 2 · investigate earlier access separately from patching, per CISA
flowchart TD
A["Review past appliance exposure"] --> B["Analyze network and memory<br/>Look for stolen accounts or data"]If compromise is suspected, responders should consider evidence preservation and service impact before following official recovery procedures. These include a factory reset or virtual-instance rebuild, upgrade, and replacement of passwords, certificates and keys. This is not an instruction for individuals to reset a PC before investigation. The KEV deadlines of November 2 and 13 concern US federal-agency response entries; they are not permission for every operator to wait until then. CISA alert
The cat asks Q&A
- The researcher
Why investigate if the checker reports no problem?
Pocket NotebookThis attack can leave evidence in memory and accounts while disk files look unchanged. A responder needs the exposure period and network and memory evidence, rather than treating one clean scan as proof of no intrusion. Credentials already stolen still need replacing after a patch.
To close
Record the installed version and the investigation separately
The new development is the additional flaws entering the exploited-vulnerability catalog and the expanded fixed-release path. Operators need two answers: which build reached which appliance, and whether earlier intruders took accounts or data. Both inform restoration and follow-up response.
Sources
- KEV feedcisa.gov
- Vendor conditionshub.ivanti.com
- CISA alertcisa.gov
- Volexity investigationvolexity.com
- vendor compatibility guidehub.ivanti.com