Patched your Ivanti VPN in October? You now need to update it a second time

On October 3, according to security firm Volexity, a previously unknown hacker began breaking into an Ivanti Connect Secure VPN appliance, the gateway that lets employees connect to their company's network. The appliance Volexity examined was fully up to date. On October 13, Ivanti released a patch for a first vulnerability. Two pieces of the puzzle were missing.

On October 29, Ivanti updated its advisory to add two more already-exploited flaws, CVE-2026-111357 and CVE-2026-118527. The next day, the US cybersecurity agency CISA added them to its Known Exploited Vulnerabilities (KEV) catalog. The direct consequence: companies that installed versions 25.1.1.2 or 22.8R2.5 in October remain exposed and must update again.

Three flaws to take full control of the appliance

On October 13, we reported on the exploitation of the first flaw, CVE-2026-104935, while the patch for another flaw in the chain was still pending. CVE-2026-104935 allows attackers to bypass authentication. According to Volexity, the attacker chained it with two other previously unknown flaws (“zero-days”) to run commands with the highest privileges (root), without even having an account.

The two new pieces, as described by SecurityWeek:

• CVE-2026-111357 (severity score of 8.8 out of 10 according to Ivanti): a critical function lacking authentication checks, which lets an authenticated attacker with local access escalate privileges. No patch existed when the attacks were made public on October 13;
• CVE-2026-118527 (4.3 out of 10): predictable credentials, which let an authenticated attacker remotely write arbitrary files to a known location on the disk.

On their own, these two flaws require the attacker to already be authenticated. Chained with the first flaw, they give full control of the appliance.

Who is behind it?

Volexity tracks the attacker as UTA0576. It assesses with low confidence that the motivation is more likely criminal than espionage. On the compromised appliance, the attacker stole credentials, exfiltrated data, scanned the network and tampered with activity logs. Ivanti says a limited number of customers were affected. Meanwhile, threat intelligence firm Defused reports that attacks it believes targeted the first flaw hit its honeypots as early as October 1, before any public disclosure.

What should you do?

The only mitigation mentioned is updating.

• Vulnerable versions: 25.1.1.2 and earlier, 22.8R2.5 and earlier.
• Fixed versions: 25.1.1.3 and 22.8R2.6. They fix the two new flaws: install them even if you applied the October patch.
• Was your appliance exposed during October? Assume credentials may have leaked. The attacker tampers with logs, so the absence of alerts proves nothing. Rotate the accounts and secrets that passed through the gateway.

US federal agencies have until today, November 2, to patch CVE-2026-111357, and until November 13 for CVE-2026-118527. A European company has no reason to give itself more time.

One question remains open: how many organizations were affected between October 3 and this second patch?