Ivanti Patches Remaining Flaws in Exploited Connect Secure Chain, CISA Sets Nov. 2 Federal Deadline

Since Volexity disclosed the Ivanti Connect Secure zero-day chain on Oct. 13, one piece of it has stayed unpatched. That changed on Oct. 29, when Ivanti published fixes for the two remaining flaws. CISA added both to its Known Exploited Vulnerabilities catalog on Friday, Oct. 30.

The two new fixes and the federal deadlines

The flaws are CVE-2026-111357, a local privilege escalation rated CVSS 8.8, and CVE-2026-118527, a predictable-filename file upload issue rated 4.3. Ivanti's Oct. 29 advisory update says the patches complete the set of vulnerabilities chained in the attacks.

The first flaw in the chain, CVE-2026-104935, covers the authentication bypass and remote code execution. It was patched on Oct. 13 and added to the KEV catalog that day.

Federal civilian agencies must apply the fix for CVE-2026-111357 by Monday, Nov. 2, and the fix for CVE-2026-118527 by Nov. 13, according to CISA.

How the chain worked

Volexity began investigating on Oct. 5 after spotting authentication failures coming from the internal interface of a VPN appliance at a customer. The box was running version 22.8R2.4, which was fully patched at the time.

Sean Koessel, Volexity's vice president of professional services, said such failures are "a telltale sign of a device that is likely compromised."

The attacker, tracked as UTA0576, first bypassed authentication through welcome.cgi. It then abused the wu.cgi upload handler, which wrote files to disk before checking whether they were valid ZIP archives. Finally it targeted the dsinvoked service, which trusts maintenance-task configuration stored in DSCache. That gave the attacker root.

Volexity says the actor then went after Active Directory secrets: Windows LAPS administrator passwords and BitLocker recovery keys. It used custom Python tools for LDAP queries and Kerberos credential testing. Investigators also saw password spraying and internal DNS reconnaissance.

The attackers installed no web shell and no backdoor. Commands and results traveled inside the exploit chain's own HTTPS requests. Volexity also said the actor deleted evidence from Ivanti debug logs and Linux audit logs.

Why patching may not settle it

The attack patched library code in memory only and restored the configuration store afterward. Volexity says Ivanti's Integrity Checker Tool may therefore miss it, and that forensic investigation is needed to find evidence of exploitation. CISA has given the same warning.

Volexity assessed with high confidence that the activity signaled preparation for lateral movement and a broader network compromise. Because the operation was disrupted, the actor's final goals are unknown. Volexity assessed with low confidence, based on the target, that the motive is criminal rather than espionage.

Timing is also disputed. Volexity places the start of exploitation at no later than Oct. 3. Defused, a threat intelligence firm, says it detected activity on Oct. 1 on its honeypots and customer systems, according to its CEO Simo Kohonen.

Ivanti's explanation for the gap

Ivanti says exploitation affected a limited number of customers and that it is helping them. The company has defended how it sequenced the fixes.

"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti said. The company added that its "focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."

Ivanti also says it found part of the privilege escalation flaw through its own product security program and fixed it in the July 25.1.3.0 release. It was still backporting that fix to other supported versions when exploitation began.

The result: a flaw Ivanti says it partly knew about in July was still exploitable on a fully patched 22.8 appliance in early October. A complete fix then took until Oct. 29.

History and what is unresolved

Rapid7 notes that Connect Secure has been hit by zero-day exploitation in both 2024 and 2025. The appliance sits on the network perimeter and brokers access to directory credentials, which makes it a repeat target.

Ivanti has not said how many customers were affected beyond "limited." Volexity's published indicators of compromise are described as limited. Defenders who ran an exposed appliance since early October now have a complete patch set but no tool that reliably tells them whether the box was already owned.

For federal agencies, the first test comes Monday: the Nov. 2 deadline for CVE-2026-111357.