Cut-paper illustration of a VPN gateway appliance between a laptop and a server rack, with a cracked orange shield, an intact teal shield layered over it, and a magnifying glass inspecting the appliance

You patched Ivanti on October 13. That patch is already out of date.

If you run Ivanti Connect Secure and applied the October 13 fix for CVE-2026-104935, you did the right thing at the time. On October 29, Ivanti updated the same advisory with two more flaws attackers had chained with the first one. On October 30, CISA added both to its Known Exploited Vulnerabilities catalog. The builds that fixed the first flaw are listed as affected by the other two. Patch again, to the right build, then prove the appliance clean.

The October 13 patch fixed one flaw in a three flaw chain

The chain starts with CVE-2026-104935, an authentication bypass by spoofing that lets a remote attacker with no login run arbitrary commands. Ivanti rates it 8.6. A request goes to the public login page, /dana-na/auth/url_default/welcome.cgi. It carries a header, X-DSCGI-PATH, naming a protected script, wu.cgi. The appliance checks the URL to decide whether the request is allowed, then routes it using the header. The two disagree, and the attacker gets through.

The second piece lives in wu.cgi. It writes an uploaded file to disk under a predictable name, the MD5 hash of the filename the client supplied, and only then checks whether the file is a valid ZIP. The attacker fires parallel requests at the predictable path and runs the file in the short window before it is deleted. That is CVE-2026-118527, the predictable filename flaw, rated 4.3 on its own. On its own it needs an authenticated attacker. Chained behind the bypass, it needed nobody.

The third piece is CVE-2026-111357, a missing authentication for a critical function that lets an attacker already on the appliance escalate to root. Ivanti rates it 8.8. The CVE record scores the same flaw lower in isolation, because in isolation it needs a foothold. Together, the three flaws gave unauthenticated root level code execution.

Volexity tracks the actor as UTA0576. Exploitation started on October 3, against an appliance running 22.8R2.4, the newest build on that line at the time. Fully patched, and owned anyway. Once inside, the actor went for credentials: stored appliance credentials, including the domain credentials used for LDAP, Active Directory queries for LAPS passwords and BitLocker recovery keys, password spraying, and capture of LDAP traffic. It left no backdoor or web shell, re-ran the whole chain for each command, and deleted evidence from Ivanti debug logs and Linux audit logs.

The version trap: 25.1.1.2 and 22.8R2.5 are still affected

Read this table by line, not by CVE.

CVE Affected versions Resolved in
CVE-2026-104935 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior 25.1.1.2; 25.1.3.0, 25.1.3.1; 22.8R2.5
CVE-2026-111357 and CVE-2026-118527 25.1.1.2 and prior; 22.8R2.5 and prior 25.1.1.3; 22.8R2.6

25.1.1.2 and 22.8R2.5 resolve CVE-2026-104935, and both are listed as affected for the other two flaws. If your change record says "patched October 13" and your build is one of those two, you are still on an affected build. The only builds that resolve all three on their lines are 25.1.1.3 and 22.8R2.6.

Two more facts cause wrong conclusions. Do not read 25.1.3.1 as a fix for the two newer flaws; it appears only in the CVE-2026-104935 resolved list. And 25.1.3.0, released in July 2026, does not contain this vulnerability, but moving to it requires the new platform, ISA4500, ISA6500, or ISA8500: new physical servers for hardware users, and new devices built from the 25.1.3.0 template for virtual and cloud users. Versions 22.7 and lower do not contain the vulnerability. The 22.8 line reaches end of life on January 31, 2027, so treat 22.8R2.6 as a bridge, not a destination.

CISA's federal due dates underline the urgency. CVE-2026-111357 was due November 2, 2026, with forensic triage required. CVE-2026-118527 is due November 13, 2026. Those dates bind US federal agencies under Binding Operational Directive 26-04. For everyone else, treat November 2 as the urgency signal, not a grace period.

Patch again, then prove it clean

Start with an inventory, not an assumption. List every Connect Secure appliance, including virtual and cloud instances and any appliance set up outside the usual change process. Record the exact build on each one. Only the build number settles whether you are affected.

On the 25.1.1 line, upgrade to 25.1.1.3. On the 22.8 line, upgrade to 22.8R2.6 if you cannot move to 25.1.1.3 yet, and plan the move to the 25.1 line before the January 31, 2027 end of life date. On 25.1.3.0 or later on the new platform, confirm the build and record that it does not contain this vulnerability. Download the builds from the Ivanti License System and follow Ivanti's upgrade and migration compatibility guide for your deployment type. Test authentication, LDAP and certificate integrations, and remote user connections before you call it done.

Patching stops the next attacker. It says nothing about the last one. CISA warns that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935, because the threat actor's commands execute in memory. The chain patches library code in memory only and restores the configuration data afterward, so the tool finds no modification on disk. A clean result on an appliance that was internet facing on an affected build is not evidence it was never exploited.

If you suspect compromise, preserve evidence before you reboot or rebuild. Capture memory first, then do network forensics. An upgrade reboots the appliance, and a factory reset wipes more. Volexity reconstructed this chain from memory images and core dumps, after the logs had been tampered with.

Hunt with the signals Volexity published: a large number of requests to /dana-na/auth/url_default/welcome.cgi, especially requests where the URL path and the X-DSCGI-PATH header point at different scripts, such as wu.cgi or a path under /home/runtime/tmp/. Check /tmp/ for post exploitation artifacts. Look for lateral movement originating from the VPN appliance, Active Directory queries for LAPS passwords and BitLocker recovery keys, password spraying, and packet capture activity on LDAP traffic.

If compromise is confirmed, or cannot be ruled out for an internet facing appliance that ran an affected build during October, follow the recovery sequence CISA reproduces from Ivanti: back up the configuration, factory reset and upgrade (rebuilding virtual and cloud instances), restore the configuration, then reset passwords for all accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.

The playbook, in order

  1. Inventory every appliance and record the exact build.
  2. Upgrade to 25.1.1.3 or 22.8R2.6, depending on your line. Do not stop at 25.1.1.2 or 22.8R2.5.
  3. Before rebooting a suspected appliance, capture memory and preserve network evidence.
  4. Hunt the welcome.cgi requests, the header mismatch, /tmp/ artifacts, and lateral movement from the appliance.
  5. If compromise is confirmed or cannot be ruled out, rebuild, restore the configuration, and reset every credential, certificate, API key, and license credential the appliance held.
  6. Record the final build, the hunt result, and the credential reset in the change record.

The October 13 patch was real, and it mattered. It closed the front door. The rest of the chain was still inside the house. Patch again, and this time, check the house before you lock up.

Sources