Ivanti closes the three-zero-day chain on Connect Secure, but its integrity checker still sees nothing

October 29, 2026. Ivanti adds two vulnerabilities to its Connect Secure advisory and ships the fixes that complete the exploit chain: CVE-2026-111357 and CVE-2026-118527. October 30, 2026. CISA adds both flaws to its KEV catalog, evidence of active exploitation. October 3, 2026. The first compromises documented by Volexity date back to this point, against an appliance that was supposedly fully patched. Why it matters: the long-awaited fix is here, but it does not cover what teams believed was already patched — and Ivanti’s Integrity Checker Tool still fails to see the compromise.

Two more flaws, and the chain snaps shut

The story starts on October 13, when Ivanti patched CVE-2026-104935, an authentication bypass in its Connect Secure VPN gateways. Volexity had just documented a chain of three zero-days that carries an unauthenticated attacker all the way to root, without a web shell or a persistent C2 channel. But one link was missing: the privilege escalation remained unpatched, with a fix promised “in the coming weeks.”

Those weeks have now passed, and the picture is complete — in both directions.

CVE-2026-111357 is a missing authentication for a critical function (CWE-306). Ivanti scores it 8.8 under CVSSv3.1: a locally authenticated attacker can escalate to root. This is the third link Volexity isolated back in October — the one that patches libdsplibs.so in memory and makes the privileged dsinvoked service run a Perl interpreter. The CVE record and Rapid7 score it lower, at 7.0, because they factor in high attack complexity and unchanged scope where Ivanti assumes low complexity and changed scope. The gap hardly matters: this is the piece that turns code execution into full appliance control.

CVE-2026-118527 is quieter, scored 4.3: a generation of predictable numbers or identifiers (CWE-340). In practice it lets an authenticated attacker drop attacker-controlled content at a known on-disk location. On its own it looks benign. Chained with the other two, it is the last lock that opens — per CISA’s KEV entry, it allows a file upload to a predictable path, exactly the primitive you need to place an executable where it belongs.

A two-stage patch that trips up teams in a hurry

The detail that will cost organizations real money is the version matrix. The October 13 patch covered CVE-2026-104935: versions 25.1.1.2 and 22.8R2.5. Plenty of teams stopped there, and reasonably so — those builds closed the announced flaw.

Rapid7 is unambiguous, though: the October 13 fixes do not remediate CVE-2026-111357 or CVE-2026-118527. You have to go further.

# Check the version of an Ivanti Connect Secure appliance.
# Fixed versions for the full chain are:
#   25.1.1.3  (25.1 branch)  — or 22.8R2.6 (22.8 branch)
# Anything older remains exposed to the two new flaws.

The fix table reads as follows. For CVE-2026-111357 and CVE-2026-118527: the 25.1.1.2 and earlier branch moves to 25.1.1.3, and 22.8R2.5 and earlier moves to 22.8R2.6. For CVE-2026-104935, 25.1.1.1 and earlier already moved to 25.1.1.2, and 22.8R2.4 and earlier to 22.8R2.5. ISA4500, ISA6500, and ISA8500 appliances on 25.1.3.0 or later are unaffected.

Ivanti recommends leaving the 22.8 branch for 25.1.1.3 or later, or applying 22.8R2.6 if migration is not immediately possible. The trap: a team that applied 25.1.1.2 believing it was current remains exposed to the two additional flaws — while CISA has already confirmed active exploitation.

A blind integrity checker, and the forensic lesson

The second takeaway fits in one sentence, and it should unsettle any CISO: Volexity reports that the observed activity evades Ivanti’s Integrity Checker Tool.

The ICT is designed to flag unexpected file changes on the appliance. The problem is structural: UTA0576, the actor tracked by Volexity, operates in memory. Every command re-runs the full chain, the result returns directly in the HTTPS response, and the disk state is restored afterward — the DSCache entry put back, the debuglog and audit.log files cleaned. A tool that compares files cannot see what was never written to disk.

The practical consequence is stark: a clean ICT result does not clear an appliance. Only a forensic analysis, memory and disk, can settle it. Volexity had to collect memory images, disk images, and core dumps to reconstruct the chain — that is the level of effort required to see what the vendor’s tool misses. Before any reboot or reset, preserve memory and logs.

# Hunt for the indicators documented by Volexity (before any reboot):
# 1. Requests to /dana-na/auth/url_default/welcome.cgi carrying an
#    X-DSCGI-PATH header, e.g.:
#      X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi
# 2. Suspicious files under /tmp/ (ml.py, rq5.py, mk.py, rr.py, pu.txt)
#    and /data/.icscap/ (dsstatmond, cap*, h.py)
# 3. Exploitation IP: 108.165.147.64

This is not Ivanti’s first time at the center of an edge-device fire. The same Connect Secure line was hit by chained zero-days in January 2024 and again in January 2025, in both cases reaching from unauthenticated access to full appliance control. The pattern matters: network-edge VPN gateways are the highest-value perimeter asset an attacker can reach before breaching the internal network, and Ivanti has become a repeat target precisely because these appliances sit outside most EDR coverage. Each recurrence teaches the same lesson — and this one is no different: applying the patch and verifying the appliance are two separate jobs.

What the attacker came for

The end goal was not the gateway — it was the Active Directory behind it. Volexity observed theft of domain credentials, LDAP queries targeting LAPS passwords for local administrators, and BitLocker recovery keys. In other words: once root was achieved on the VPN gateway, the attacker pivoted to the secrets that unlock the rest of the estate.

That is what justifies treating this as a directory compromise, not just a patch to apply. Exposed LAPS passwords, BitLocker keys, and AD service accounts must be rotated after remediation — even if the ICT reported nothing.

Verdict

If you run Ivanti Connect Secure, patch to 25.1.1.3 or 22.8R2.6 immediately — not 25.1.1.2, which does not cover the two new flaws. CISA has already confirmed active exploitation; the federal deadline is running. If you already applied the October 13 patch, patch again: you are not protected against CVE-2026-111357 and CVE-2026-118527. And in every case, do not settle for a clean ICT scan: preserve memory and logs, hunt for Volexity’s IOCs, and if there is any doubt, follow Ivanti’s rebuild procedure and then rotate the exposed AD secrets. The chain can now be patched — but confidence in an appliance’s state is not restored by a reboot.

References

• Rapid7 — Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527), November 2, 2026
• CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 30, 2026
• Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, October 13, 2026
• Ivanti — Security Advisory CVE-2026-104935 (updated)