If you patched your Ivanti Connect Secure VPN appliances in mid-October and moved on, you need to go back. On October 29, 2026, Ivanti updated its advisory with two more vulnerabilities, CVE-2026-111357 and CVE-2026-118527, that complete the zero-day chain attackers used to get unauthenticated root on fully patched gateways, and on October 30 CISA added both to its Known Exploited Vulnerabilities (KEV) catalog. The federal remediation deadline for CVE-2026-111357 is today, November 2. The threat actor behind it, tracked by Volexity as UTA0576, used root on the VPN box to pull LAPS passwords and BitLocker recovery keys straight out of Active Directory. Here’s what changed, which builds actually close the chain, and why the cleanup goes well beyond the appliance.
The Missing Pieces of the Chain
When Volexity first published its findings on October 13, it described a three-part chain: an authentication bypass, a remote code execution bug, and a privilege escalation. The first two were tracked as CVE-2026-104935 and fixed that day. The privilege escalation had no patch yet. That gap is now closed:
- CVE-2026-111357: a missing authentication for critical function flaw (CWE-306) that Ivanti scores CVSS 8.8. It lets code already running on the appliance escalate to root. This is the privilege escalation Volexity saw in the wild.
- CVE-2026-118527: a predictable identifier flaw (CWE-340) that Ivanti scores CVSS 4.3. According to CISA’s KEV entry, it lets a remote authenticated attacker upload attacker-controlled content to a known location on disk. Ivanti’s updated advisory names it as an additional component of the chain.
- CVE-2026-104935: the original authentication bypass and RCE, already on KEV since October 13.
Don’t let the modest individual scores fool you. As Rapid7 put it, “the combined impact warrants emergency remediation despite the individual CVSS ratings,” and the firm notes that the October 13 fixes in 25.1.1.2 and 22.8R2.5 do not remediate either new CVE.
What UTA0576 Did With Root
Volexity says UTA0576 began exploiting the chain on October 3, 2026 against an appliance running 22.8R2.4, which was fully patched at the time. Once inside, the actor treated the VPN gateway as a launchpad into the directory. Volexity’s list of post-exploitation activity reads like a credential theft checklist:
- Stored credentials: domain credentials used by the appliance for LDAP were extracted.
- Directory secrets: a custom Python LDAP tool used the appliance’s own Active Directory service account to search for LAPS local administrator passwords, BitLocker recovery information, and password-bearing attributes.
- Kerberos abuse: a custom tool capable of Kerberoasting and credential testing was deployed.
- Reconnaissance: password spraying, packet capture of LDAP traffic, review of authentication logs for valid usernames, and collection of the appliance configuration.
The lesson for anyone running an SSL VPN: the service account your gateway binds to AD with can see far more than you might think. If it can read LAPS or BitLocker attributes, a compromised gateway hands those secrets over too.
Which Builds Fix It
CISA lists affected versions as 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. Rapid7’s summary of Ivanti’s advisory gives these fixed releases:
- CVE-2026-111357 and CVE-2026-118527 on 25.1.1.x: upgrade to 25.1.1.3.
- CVE-2026-111357 and CVE-2026-118527 on 22.8: upgrade to 22.8R2.6.
- CVE-2026-104935: fixed in 25.1.1.2, 25.1.3.0 / 25.1.3.1 (for the 25.1.2 train), and 22.8R2.5.
If you’re on the 25.1.2 or 25.1.3 train, confirm in Ivanti’s advisory that your target build covers all three CVEs before you call it done. And keep the calendar in mind: CISA notes that Ivanti Connect Secure 22.8 reaches end of life on January 31, 2027, so this is a good moment to plan the jump to 25.x using Ivanti’s upgrade and migration compatibility guide.
Assume Breach, Then Rotate
CISA flags CVE-2026-111357 as requiring forensic triage under BOD 26-04, which is a strong hint for everyone else too. If your appliance was exposed to the internet during October, CISA’s recommended recovery steps are:
- Back up the configuration: export the binary configuration before you touch anything.
- Factory reset and upgrade: reset hardware appliances, or rebuild cloud and virtual instances, then upgrade to the latest fixed release.
- Restore the configuration: bring the backed-up config onto the clean build.
- Reset everything: reset passwords for all domain, administrator, and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.
Given what Volexity saw, add the AD-side work to that list: rotate the appliance’s LDAP bind account, rotate LAPS passwords and BitLocker recovery keys that account could read, reset passwords on Kerberoastable service accounts, and hunt domain controller logs for LDAP queries from the gateway’s IP address.
Looking Ahead
This is the third straight year Ivanti’s VPN line has been hit by in-the-wild zero-days, and the pattern is familiar: a partial fix ships, defenders exhale, and the rest of the chain lands two weeks later. Treat any edge appliance advisory as a living document and re-check it until the vendor and the original researchers both say the chain is fully closed.
Longer term, the AD exposure is the part worth fixing even if you never run Ivanti again. Scope VPN and firewall service accounts to the minimum LDAP read rights they need, keep LAPS and BitLocker attributes away from them, and alert on unusual directory queries from network appliances. Edge devices will keep getting popped; the goal is making sure a popped gateway isn’t also a skeleton key.
Sources:
- CISA, October 30, 2026
- CISA (updated alert), October 30, 2026
- Rapid7, November 2, 2026
- Volexity, October 13, 2026 (updated October 29, 2026)
