Ivanti Connect Secure Zero-Day Chain Delivers Root Access: Patch to 25.1.1.3 Now

The three-CVE chain works by removing authentication requirements, elevating privileges to root, and then landing attacker-controlled code on the appliance. Each CVE handles one link in the sequence.

CVE-2026-104935: Authentication Bypass (base of the chain). Ivanti Connect Secure exposes a user-facing SSL VPN portal that internet-facing deployments make publicly reachable. CVE-2026-104935 bypasses the authentication check on a specific endpoint within this portal, allowing an unauthenticated attacker to reach internal API functions that should require a valid session. Ivanti patched this on October 13, 2026, but organizations that did not apply the patch remain exposed at this step, and even patched appliances face the second and third links through related API surfaces.

CVE-2026-111357: Privilege Escalation (CVSS 8.8, missing authorization). After the authentication bypass provides a foothold in the appliance API, CVE-2026-111357 allows an attacker to call a privileged function without the authorization check the vendor intended. Ivanti rates this 8.8; the NVD record assigns 7.0 under CVSS v3.1. The discrepancy reflects how each party models the authentication pre-requirement. In the chained context, where CVE-2026-104935 removes the authentication barrier, the effective impact matches Ivanti's 8.8 assessment. The result is root-level access to the appliance operating system.

CVE-2026-118527: File Upload via Predictable Identifiers (CVSS 4.3, completes code execution). Once an attacker holds root-level API access, CVE-2026-118527 enables writing an attacker-controlled file to a path on the appliance filesystem using a predictable identifier scheme. This converts root API access into persistent code execution -- the uploaded file can be a webshell, a reverse-shell payload, or a modified system component. Ivanti rates this 4.3 in isolation; in the chain, it completes the code-execution primitive.

The full chain requires no credentials at any step. An attacker with network access to the VPN portal can complete all three steps without authenticating, without interacting with any real user, and without triggering typical authentication failure alerts.

Prior Ivanti VPN exploitation campaigns followed the same architectural pattern. The Ivanti Connect Secure CVE-2026-104935 authentication bypass post documents the earlier intrusion infrastructure UTA0576 used to establish the initial foothold this chain extends.

Ivanti Connect Secure maintains two active release branches. Both are affected and both received patches on November 2, 2026.

Organizations running 21.x or older must upgrade to a supported branch before applying the patch. There is no backport for end-of-support versions.

A critical note on partial patching: Applying the October 13 patch for CVE-2026-104935 alone does not close the chain. CVE-2026-111357 has additional entry points through the privileged API that remain reachable even after the authentication bypass is closed. Ivanti's November 2 advisory covers all three CVEs. The October 13 patched version (25.1.1.2 on the 25.x branch) is still vulnerable to CVE-2026-111357 and CVE-2026-118527. The November 2 patch is the first release that addresses all three links.

No scanner check available: As of November 1, 2026, no released scanner check was available for CVE-2026-111357 or CVE-2026-118527. Do not rely on vulnerability scanners to confirm patch status -- check the installed version directly through the Ivanti admin console or CLI.

Volexity confirmed UTA0576 began chaining all three zero-days against production Ivanti Connect Secure appliances by at least October 1, 2026 -- 32 days before the November 2 patch release. The timeline below shows the progression of disclosure and exploitation.

October 1 or earlier: UTA0576 begins active exploitation of the three-CVE chain against internet-facing Ivanti Connect Secure appliances. Volexity's investigation into victim appliances documents root-level compromise and attacker persistence during this window.

October 13: Ivanti patches CVE-2026-104935 (the authentication bypass) after Volexity's initial disclosure. UTA0576 continues exploiting appliances that have not applied the October 13 update, and maintains access on already-compromised targets through the two remaining, unpatched chain links.

October 30: CISA adds CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog, setting federal remediation deadlines of November 2 (CVE-2026-111357) and November 13 (CVE-2026-118527).

November 2: Ivanti releases ICS 25.1.1.3 and 22.8R2.6, patching all three CVEs. The federal remediation deadline for CVE-2026-111357 expires the same day.

The pattern of activity -- sustained exploitation for 30+ days on a network-facing target, using chained zero-days against a VPN appliance -- is consistent with UTA0576's documented intrusion methodology. Previous Ivanti campaigns attributed to the same cluster installed GIFTEDVISITOR webshell variants and used SAML trust modifications to maintain access through credential rotations and partial remediation steps.

Ivanti's own history of VPN zero-days, including the CVE-2025-0282 stack overflow RCE documented in early 2025, shows this product line is under sustained targeting by sophisticated actors. Organizations with Ivanti VPN infrastructure should assume persistent threat actor interest and treat any exposure window as a likely compromise event.

Network-layer IOCs for the three-CVE Ivanti Connect Secure chain are not yet publicly released. The behavioral indicators below are derived from the documented attack chain and post-exploitation patterns Volexity observed in prior Ivanti VPN compromise investigations. Use these to hunt in SIEM and EDR telemetry dating back to October 1.

Monitor Ivanti Connect Secure access logs for POST requests to privileged API endpoints that lack valid session tokens or use malformed authentication headers. On ICS appliances, the admin web interface logs are stored at /home/webserv/logs/ and user-portal access logs at /data/var/log/. Any request from an external IP to an admin-tier API path without a preceding successful authentication event is a strong exploitation indicator.

Post-exploitation persistence on ICS appliances has historically used writable runtime directories. Check for unexpected files -- particularly .cgi, .php, .pl, or binary executables -- in /data/runtime/mtmp/, /home/webserv/cgi-bin/, and /tmp/. Any process running as root that is a child of the web server (httpd, lighttpd, or the Ivanti-specific web daemon) and spawning sh, bash, or python indicates active or past compromise.

Run Ivanti's Integrity Checker Tool (ICT) to compare the appliance file system against the vendor's known-good baseline. The ICT is available through Ivanti's support portal and should be run immediately, before applying the patch, to preserve forensic evidence of any prior compromise.

These two rules target the primary exploitation indicator (privileged API access without authentication) and post-exploitation shell spawning from the ICS web process. Both carry experimental status; validate against your Ivanti appliance log format and SIEM log ingestion pipeline before enabling automatic blocking.

Ivanti published no workaround for CVE-2026-111357 or CVE-2026-118527. Upgrading the appliance is the only fix. The steps below address both remediation and compromise assessment.

Ivanti Connect Secure is the entry point for remote access in tens of thousands of enterprise and government networks worldwide. A root-compromised VPN gateway is not a perimeter device with limited blast radius -- it is a trusted insider with access to every connected user's traffic, credentials, and destination systems.

The three-CVE chain changes the threat calculus in a specific way: an organization that applied the October 13 patch for CVE-2026-104935 and considered itself protected was still fully vulnerable. Two of the three chain links remained unpatched until today. Attackers who had already established access through CVE-2026-104935 maintained that access through the two remaining vulnerabilities, and attackers who found the October 13 patch already applied on a target could still use CVE-2026-111357's missing-authorization primitive to reach root through a different code path. The partial-patch-equals-full-protection assumption is false for this vulnerability set.

The exploitation pattern -- 32 days of pre-patch access, a state-aligned threat actor, and root persistence on VPN infrastructure -- maps precisely to the pre-positioning phase of espionage intrusions. Organizations in sectors targeted by UTA0576 (government, defense, technology, critical infrastructure) should not wait for evidence of post-exploitation activity before beginning incident response. The 30-day hunt queries above cover the full exploitation window from October 1. Any hit should be treated as a confirmed compromise pending investigation, not as a suspicious anomaly pending confirmation.

Ivanti's history of VPN zero-days -- multiple critical CVEs in consecutive years -- is a pattern, not a coincidence. Perimeter VPN appliances from any vendor are high-value targets under sustained research by sophisticated actors. Defense programs that rely on single-vendor perimeter access controls without compensating controls (MFA enforcement on the internal side, anomaly detection on VPN session behavior, zero-trust segmentation behind the VPN gateway) amplify the blast radius of any future perimeter compromise.