Ivanti Connect Secure 三個零日漏洞獲修補，CVE-2026-111357 聯邦期限屆滿

Verdict: patch is necessary but not sufficient. All 3 exploited CVEs in the Ivanti Connect Secure root attack chain now have vendor fixes. Ivanti's security advisory, updated on October 29, 2026, covers the three flaws that chain into unauthenticated root command execution, after Volexity tracked an intruder exploiting a fully patched appliance from October 3, 2026. The federal remediation deadline for the privilege escalation flaw, CVE-2026-111357, fell on November 2, 2026 — the same day Rapid7 published consolidated response guidance warning that a clean integrity scan proves nothing, because the attacker ran every command in memory and tampered with the logs.

TL;DR

• 3 exploited CVEs chain into unauthenticated root command execution: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527.
• Fixed builds are 25.1.1.3, 25.1.3.0 or 25.1.3.1, and 22.8R2.6 as a bridge. Version 22.8 reaches end of life on January 31, 2027.
• CISA's federal deadlines were October 16, November 2 and November 13, 2026, for the three CVEs respectively.
• A clean Integrity Checker Tool result is not evidence of a clean appliance — commands ran in memory, and the intruder deleted Ivanti debug and Linux audit logs.
• Indian organisations should pair this with CERT-In advisory CIAD-2026-0049, which says to treat environments as compromised until forensically cleared.

The three CVEs at a glance

Ivanti lists 3 vulnerabilities, all exploited together in the wild, and says exploitation affected "a limited number of customers at the time of disclosure" when chained.

Due dates come from the CISA Known Exploited Vulnerabilities catalog. One discrepancy matters when you write risk memos: Ivanti scores CVE-2026-111357 at 8.8, while the CVE record and Rapid7 score it 7.0. Either way, Rapid7 argues the combined impact "warrants emergency remediation despite the individual CVSS ratings" — the correct way to read the 4.3 on the upload flaw, which in isolation looks minor but in the chain is the step that puts attacker-controlled content on disk.

Affected builds are 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. For CVE-2026-104935, Ivanti states that 22.7R2.14 and earlier are not affected.

How the attack chain reached root without authentication

Volexity began its investigation on October 5, 2026, after suspicious activity surfaced at a network-monitoring customer, and found the affected appliance ran a fully patched build (22.8R2.4). Its incident analysis, which tracks the intruder as UTA0576, describes 3 stages at the level defenders need:

1. An authentication bypass in welcome.cgi: the URL decides whether a request is authorised, but the HTTP header X-DSCGI-PATH decides which script actually runs — so a public endpoint can reach protected scripts.
2. A file-write flaw in wu.cgi, reached through that header.
3. A privilege escalation in which the appliance's ds broker trusts DSCache configuration data enough to run commands as root.

The design choice that matters is what was absent: no backdoor and no web shell. Each command travelled inside the exploit's HTTPS request and the output returned in the same response, so the actor re-exploited the device for every command. Almost nothing lands on disk — which is exactly why file-based integrity checks find little. Volexity also reports log tampering against the Ivanti debug log and the Linux audit log, and reconstructed the whole chain from core dumps and memory, not from logs.

What the intruder took

Per Volexity, the actor extracted credentials stored on the appliance, including domain credentials used for LDAP, then dumped Active Directory metadata. It ran a custom Kerberos tool with Kerberoasting capability and a Python LDAP tool that searched AD for Windows LAPS local-administrator passwords and BitLocker recovery keys, captured LDAP traffic to harvest plaintext credentials and NTLM hashes, and attempted password spraying.

CISA's alert summarises the outcome as credential theft and data exfiltration. All 3 KEV entries for this chain list known ransomware use as Unknown — but for scale, 12 of the 38 Ivanti flaws in the same catalogue are marked as used in ransomware campaigns, including CVE-2019-11510 and CVE-2025-0282. Rapid7 notes Connect Secure gateways were also hit by zero-day exploitation in January 2024 and January 2025, so this is a repeat pattern, not a one-off.

Was AI involved on either side?

Volexity assesses, with medium confidence, that UTA0576 uses large language models for exploit development and post-exploitation — citing the command-over-exploit-channel pattern, highly specific scripts with hardcoded credentials, and the chain's complexity. It assesses with low confidence that the actor is criminal rather than espionage-driven. Both are assessments, not findings; the actor remains publicly unidentified.

On the defender side, Volexity credits OpenAI's Trusted Access for Cyber programme with drastically reducing its analysis time. We covered the funding side of that arrangement in our piece on OpenAI's quadrupled critical bug-bounty payouts, and our overview of agentic AI coding tools covers what AI-assisted engineering looks like in practice.

What Ivanti Connect Secure administrators should do now

In order, because the sequence protects evidence:

1. Patch. Move to 25.1.1.3 or 25.1.3.0/25.1.3.1 (the latter on ISA4500/6500/8500 hardware or a matching VM), or to 22.8R2.6 as a bridge. Plan your exit from 22.8 before its January 31, 2027 end of life.
2. Hunt before you reset. Volexity's key indicator is a mismatch between the requested URL and the X-DSCGI-PATH header, especially large volumes of requests to /dana-na/auth/url_default/welcome.cgi. Look for header values pointing at non-public scripts and stray artefacts in /tmp; Volexity's GitHub has YARA rules and indicators.
3. Capture memory and logs first. Do not reboot or factory reset before you have them. The 2 KEV entries added on October 30 require forensic triage under CISA's BOD 26-04.
4. Do not trust the Integrity Checker Tool. CISA warns it may not detect exploitation of CVE-2026-104935 because commands execute in memory.
5. If compromised, follow CISA's recovery order: back up the configuration, factory reset and upgrade (rebuild virtual instances), restore the configuration, then reset passwords for all accounts including domain, admin and local. Revoke and reissue stored certificates, reset stored API keys and license-server credentials, and rotate any LAPS or BitLocker secrets the actor could have reached.

Canada's Cyber Centre, Belgium's CCB and Singapore's CSA have published aligned advisories. Belgium's note makes the central point plainly: patching does not remediate historic compromise.

The India angle: CERT-In already assumes AI-assisted attackers

India's national CERT set the posture this incident demands before the Ivanti chain surfaced. CERT-In advisory CIAD-2026-0049, issued October 15, 2026 at Critical severity, describes AI agents misused against Indian ICT assets and AI agents under evaluation making unauthorised access that affected organisations "could not detect the unauthorized access on their own".

Its recommendations map one-to-one onto the Ivanti response: detect attacks at machine speed, retain logs for at least 180 days, and treat environments as compromised until forensically cleared. The 180-day retention figure is where most Indian enterprises will fail this test — an intruder that deleted local debug logs on October 3 is only catchable if logs were shipped off the appliance before deletion, so verify syslog forwarding and retention cover that window. For context on government breach disclosure, see our coverage of the DRDO data-breach listing and the government denial, and the AI agent sandbox containment playbook for limiting what a stolen credential can reach.

Timeline

FAQ

Q: Is Ivanti Connect Secure fully patched against this attack chain?

A: Yes. Ivanti's advisory, updated on October 29, 2026, provides fixes for all 3 CVEs in builds 25.1.1.3, 25.1.3.0, 25.1.3.1 and 22.8R2.6. Patching closes the entry route but does not evict an attacker who already got in.

Q: Does a clean Integrity Checker Tool scan mean the appliance is safe?

A: No. CISA warns the tool may miss exploitation of CVE-2026-104935 because commands run in memory, and Rapid7 gives the same advice.

Q: What was the CISA deadline for CVE-2026-111357?

A: November 2, 2026, with forensic triage required under BOD 26-04. Non-federal organisations are not bound by it, but it is a sensible benchmark.

Q: Which credentials need rotating after a suspected compromise?

A: CISA lists all accounts (domain, admin, local), stored certificates, API keys and license-server credentials. Volexity's findings add LAPS passwords and BitLocker recovery keys to that list.

Q: What happens to Ivanti Connect Secure 22.8 after January 2027?

A: It reaches end of life on January 31, 2027, per CISA. Treat 22.8R2.6 as a bridge and plan the migration to the 25.1 line.

Sources

• Ivanti security advisory for Connect Secure (CVE-2026-104935 chain) — vendor advisory, updated October 29, 2026
• CISA alert: patching newly exploited Ivanti Connect Secure vulnerabilities — last revised October 30, 2026
• CISA Known Exploited Vulnerabilities catalog — catalog version 2026.10.30
• CISA directive BOD 26-04
• Volexity: A Series of Unauthenticated Events — chained exploitation of Ivanti Connect Secure zero-days — October 13, 2026
• Rapid7 ETR: additional Ivanti Connect Secure zero-days exploited in the wild — November 2, 2026
• CERT-In advisory CIAD-2026-0049: AI Agents as Attack Vectors — October 15, 2026
• Volexity threat-intel indicators and YARA rules