Ivanti’s Exploited VPN Chain Now Has Additional Fixes

Update, 30 October 2026: complete the chain fixes

Ivanti’s 29 October advisory update adds fixes for two further components of the exploited Connect Secure chain. CVE-2026-111357 allows a local authenticated attacker to raise privileges; CVE-2026-118527 allows a remote authenticated attacker to place attacker-controlled content at a predictable disk location. Ivanti rates them 8.8 High and 4.3 Medium respectively, and reports limited customer exploitation when the three flaws were chained at disclosure.

The earlier fixes for CVE-2026-104935 addressed the primary entry path. They must not be mistaken for the later fixes for the additional components:

Ivanti recommends moving from 22.8 to 25.1.1.3 or later, with 22.8R2.6 available for customers unable to make that move immediately. It explicitly says 22.8R2.6 and the ISA6000/ISA8000 route to 25.1.1.3 resolve all vulnerabilities in this disclosure. The 31 January 2027 end of support for 22.7/22.8 still matters.

Keep the platform decision separate. The compatibility guide, modified 22 October, retains the hardware and migration restrictions described below and requires vTPM for virtual deployments. Its matrix does not list 25.1.1.3 or 22.8R2.6 as target rows. Confirm the supported route for the exact source build and appliance before scheduling the change; the new patch targets do not establish a universal in-place upgrade path.

There are two published severity assessments for the privilege escalation. Ivanti’s 8.8 assessment uses low attack complexity and changed scope. The MITRE CVE record assigns 7.0 High, with high attack complexity and unchanged scope, and explicitly enumerates 22.8R2.4 while leaving other versions unknown. These are distinct assessments; the current vendor advisory supplies the patch matrix.

Read each CISA entry separately

The current CISA catalogue lists all three flaws. These are its recorded dates and forensic-triage flags, all in 2026:

CISA records ransomware campaign use as unknown for each entry. The “No” flag on the file-upload flaw does not clear an appliance of compromise or cancel triage associated with the rest of the chain. Under BOD 26-04, covered agencies determine applicable remediation timelines asset by asset, including actual exposure; the catalogue dates are not universal deadlines for every deployment or organisation.

Keep the exposure investigation open

Volexity’s added note confirms the privilege-escalation patch was published on 29 October and says the rest of its original report is unchanged. Its older future-tense references to that patch describe the position at publication. Neither the new patch nor today’s catalogue additions date the first attacks, which Volexity traced to 3 October.

Retain an investigation owner alongside the upgrade owner. CISA’s implementation guidance calls for preserving evidence before patching where possible, then analysing whether compromise occurred and deciding whether to escalate. Its suggested hourly triage milestones are best-practice guidance, not mandatory milestones. The new builds do not establish that an earlier intrusion has been removed.

Earlier patch and migration guidance: The first-fix table and exclusion below concern the original authentication-bypass flaw. Read them alongside the later chain fixes above.

Select the fixed branch

22.7R2.14 and prior are excluded; 22.7/22.8 support ends on 31 January 2027.

Volexity describes patch publication on 13 October; Ivanti’s build dates differ.

The appliance determines the route

The compatibility guide distinguishes factory hardware from older physical and virtual deployments. 25.1.2.1 is ISA6500 hardware-only; 25.1.2.2 is ISA6500/ISA8500 hardware-only. Those eligible systems can upgrade directly to 25.1.3.0. The older models in the table require migration for that destination. New virtual deployments need the destination image. For 25.1.3.1, its 15 October matrix lists in-place upgrades only from 25.1.3.0.

Direct cluster upgrades from 22.8R2 to 25.x are unsupported: break the cluster, upgrade members individually and recreate it. Check the exact source build before choosing a route.

A patch target and a migration destination are different decisions. Change approval should name the intended route, its effect on service availability and the post-change build verification.

Investigate the exposure window

Volexity traced 3 October attacks to then-patched 22.8R2.4 Build 19097: credential theft, restored changes and deleted logs. A separate privilege escalation gave root. Its fix was still pending when Volexity published on 13 October; Volexity’s added note confirms that Ivanti released it on 29 October. Clean integrity checks cannot exclude compromise.

Ivanti recommends checks; indicators are limited.

Verify the installed build, but retain exposure-window evidence and an investigation owner after the upgrade.

Read the deadline in its proper scope

The CISA catalogue added the flaw on 13 October, lists 16 October as the due date and requires forensic triage. Ransomware use is unknown.

BOD 26-04 applies to in-scope US Federal Civilian Executive Branch systems, not every organisation. Contractor obligations depend on the governing procurement contract; agencies must review contracts for changes needed to comply. Other operators should treat confirmed exploitation as a prioritisation signal without describing the catalogue date as their universal legal deadline.

The recovery page requires sign-in. Its restricted procedures are not reproduced here. Keep collection and recovery within your authorised incident-response process.

Sources

• Ivanti advisory
• Volexity report
• Compatibility guide
• CISA catalogue
• BOD 26-04
• MITRE privilege-escalation CVE record
• CISA implementation guidance