Ivanti Connect Secure Flaws Chain Leads to Unauthenticated Root Access

On October 31, 2026, The Hacker News reported that attackers linked three separate flaws in Ivanti Connect Secure to run code as the system’s root user without any authentication. The chain combines an authentication bypass, a remote code execution, and a privilege‑escalation bug, and it has been observed stealing credentials and Active Directory data.

What the Exploit Chain Involves

According to The Hacker News, the first step in the chain is an authentication bypass identified as CVE‑2026‑104935. This flaw lets an unauthenticated attacker reach a function that should require a valid login. The second component, CVE‑2026‑111357, is a missing‑authentication issue that allows a local authenticated user to elevate privileges. The third piece, CVE‑2026‑118527, generates predictable identifiers, enabling a remote authenticated attacker to upload files to a known disk location. Volexity described the combination as "unauthenticated root‑level code execution," meaning the attacker can execute commands with the highest system rights without first logging in.

Impact on Organizations

The chain is more than a technical curiosity. The threat actor, tracked as UTA0576, has used the vulnerabilities to extract user credentials, limited Active Directory metadata, and even search for administrator passwords and BitLocker recovery keys. In other exploit scenarios, attackers drop web shells or ransomware; in this case, they are gathering information that can be leveraged for further attacks on the network. Any organization that runs Ivanti Connect Secure (ICS), a product used to provide secure remote access for employees and contractors, could be exposed if the software is not updated.

Patch Availability and Deadlines

Ivanti confirmed that patches for the two most recent flaws, CVE‑2026‑111357 and CVE‑2026‑118527, are now available. The fixes are included in version 25.1.1.3 (replacing 25.1.1.2) and version 22.8R2.6 (replacing 22.8R2.5). The company also had a fix for the authentication bypass (CVE‑2026‑104935) in quality‑assurance at the time the chain was discovered and released it quickly.

Federal Civilian Executive Branch agencies are required to install the CVE‑2026‑111357 patch by November 2, 2026, and the CVE‑2026‑118527 patch by November 13, 2026. While the mandate applies to federal entities, the same timelines are a good reference for private and nonprofit organizations that want to stay ahead of the threat.

Immediate Actions for Administrators

If your environment uses Ivanti Connect Secure, follow these steps right away:

• Verify the current version of ICS on every gateway. The version number appears in the admin console under System Information.
• If you are on 25.1.1.2 or earlier, upgrade to 25.1.1.3. If you are on 22.8R2.5 or earlier, upgrade to 22.8R2.6.
• Confirm that the patch for CVE‑2026‑104935 is already applied; most recent releases include it.
• Review firewall and VPN logs for any unusual remote connections, especially from IP addresses that have not been seen before.
• Conduct a credential audit. Reset passwords for privileged accounts and enable multi‑factor authentication where possible.
• Search the file system for unexpected files in the upload directory used by the RCE component. Delete any unknown files and investigate their origin.
• Run a network scan for open ports that should be closed, and ensure that only required services are exposed to the internet.

How to Verify Your System Is Protected

After applying the patches, perform a quick verification:

1. Log in to the ICS admin console and check the patch level displayed.
2. Use a vulnerability scanner that includes the three CVE identifiers to confirm they are no longer reported.
3. Attempt a controlled test of the authentication bypass by sending a request to the known vulnerable endpoint; a properly patched system should reject the request with an authentication error.
4. Review the system’s audit logs for any entries that reference the CVE IDs; successful patching should result in no new entries.

Keeping the remote‑access gateway up to date is a core part of a broader security program. Regular patch cycles, strong credential hygiene, and continuous monitoring reduce the chance that a similar exploit chain can be assembled against your infrastructure.

For organizations that need a quick health check, consider running an external scan to see what an attacker might view from the internet. Our free tool can give you a snapshot of exposed services and known vulnerabilities.

Key points to remember: the three Ivanti Connect Secure flaws are being actively weaponized, the exploit chain grants unauthenticated root access, patches are already released, and federal agencies have hard deadlines that private groups should follow as a best practice. Applying the updates, tightening access controls, and monitoring for anomalous activity are the most effective ways to mitigate the risk.

Want to know how exposed your own site is? Start with a free external scan.