A chain, not a single bug

The incident involves three flaws in Ivanti Connect Secure chained together. The first, tracked as CVE-2026-104935 and rated 8.6, provides an authentication bypass and remote code execution. Ivanti patched that flaw on 13 October. The two flaws fixed on 29 October complete the picture: CVE-2026-118527, a predictable-filename weakness rated 4.3, and CVE-2026-111357, a privilege-escalation flaw that lifts an attacker to root on the appliance.

Taken on their own, the later flaws look less dramatic than the first. Their danger comes from combination. Once an intruder has a foothold through the first flaw, the file-handling weakness helps place material on disk, and the escalation flaw turns that foothold into full control of the VPN device. A VPN appliance is a particularly sensitive target because it sits at the edge of a network and often holds credentials and session information.

What the researchers observed

Volexity, which first spotted the activity, tracks the intruder as UTA0576. Its investigation began in the first week of October, when a fully patched appliance running version 22.8R2.4 was found compromised. The researchers describe the attacker's methods as focused on stealing credentials, taking data, altering logs and mapping the network, including targeting directory-service secrets and recovery keys.

One detail stood out as unusual. Rather than planting a persistent backdoor in the normal sense, the attacker appeared to pass each command and receive each result inside the exploit chain's own web requests, re-running the full three-stage chain for every command. That approach helps explain why some on-disk checks missed the activity: much of the intrusion left little trace in the places those checks examine.

What administrators should do now

Ivanti's 29 October fixes cover the remaining flaws, with versions 25.1.1.3 and 22.8R2.6 among the releases resolving the full chain on those branches. Administrators should upgrade to the fixed release for their own branch and confirm the version after the upgrade, rather than assuming an earlier October patch already closed the issue.

Patching alone is not presented as sufficient for devices that may already have been targeted. Ivanti points customers to the indicators in Volexity's analysis and to its Integrity Checker Tool, and any appliance showing signs of lateral movement or unexpected changes should be investigated forensically.

Sources: Volexity