Small Town Sysadmin
Free CJIS checklist

NetworksUpdated November 2, 2026

Security alert

Patch Ivanti Connect Secure now: a zero-day login bypass is being exploited, and the integrity checker won't catch it

CISA added an exploited Ivanti Connect Secure authentication bypass on October 13, 2026. Here is who is affected, what to do today, and how to respond if the VPN may already be compromised.

If your office or agency uses an Ivanti Connect Secure VPN appliance, patching it is today’s job. On October 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog and urged organizations to update. CISA describes it as a zero-day authentication bypass that lets a remote, unauthenticated attacker run commands on the appliance. Attackers have used it to steal credentials and data.

Update, November 2, 2026: two more flaws, and a patch for the privilege-escalation one

On October 30, CISA added two more Ivanti Connect Secure flaws to the KEV catalog and updated its alert. Both can be chained with the original login bypass:

  • CVE-2026-118527: lets an attacker who is already logged in upload files with content they control to a known location on the appliance. CISA’s federal due date is November 13, 2026.
  • CVE-2026-111357: lets a local, logged-in attacker raise their privileges. CISA’s federal due date is November 2, 2026. Volexity says Ivanti released a patch for this one on October 29, 2026. Its report originally said the fix was still in development, so older copies of that report are out of date.

What to do: if you patched only for the October 13 flaw, check Ivanti’s advisory again and install the latest release for your version train. Then re-run the compromise checks below, since the chain was already being used before these fixes. I could not load Ivanti’s advisory when writing this update, so take exact fixed build numbers from Ivanti.

Who is affected

After its October 30 update, CISA lists these Ivanti Connect Secure versions as affected:

  • 25.1.1.2 and earlier
  • 25.1.2.2 and earlier
  • 22.8R2.5 and earlier

If you have a Connect Secure appliance (hardware or virtual) that users or vendors reach from the internet, assume you are in scope until you have checked the version. Many small agencies and MSP-managed shops run these as their remote-access VPN.

Note that Connect Secure 22.8 reaches end of life on January 31, 2027, according to CISA. If you are on that train, plan the move to the 25.x line now rather than patching and forgetting.

What to do today

  1. Find your appliances and versions. Check the admin console for each Connect Secure device, including ones an MSP or vendor set up for you.
  2. Apply Ivanti’s update. Follow the fixes listed in Ivanti’s security advisory for CVE-2026-104935 (linked below). CISA’s instruction is to update to the latest available version, and to read Ivanti’s upgrade compatibility guide first, since not every older hardware model supports the 25.x line. I could not load the advisory’s per-train fixed version numbers when writing this, so take the exact target build from Ivanti’s page, not from this article.
  3. Check whether you were already hit. The timing matters: security firm Volexity, which reported the attack, says exploitation began on October 3, 2026, ten days before the patch. Patching closes the door but does not remove an attacker who is already inside.
  4. Document it. KEV entries carry a remediation deadline for federal agencies (October 16, 2026 in the catalog). State, local, and bank examiners tend to treat KEV items as the benchmark, so document the date you patched.

Ivanti’s Integrity Checker Tool may not detect this exploitation, because the malicious commands run in memory. A clean integrity-check result does not mean the appliance is clean.

Signs of compromise

Volexity’s write-up says the attackers left no web shell or backdoor, which makes this harder to spot. Things worth checking, if you or your MSP can pull the logs:

  • A large volume of requests to the appliance’s login welcome page, especially from a single outside address.
  • Web requests where an internal routing header does not match the page requested. Volexity recommends alerting on any mismatch.
  • Unexpected files in the appliance’s temporary directory, or a hidden capture directory under its data folder.
  • Gaps or truncation in the appliance’s debug and audit logs. Attackers deleted log entries, so missing logs are a warning sign, and clean logs prove little.
  • On the network side: LDAP queries, Kerberos activity, or password-guessing against your domain that traces back to the VPN appliance’s address.

Volexity also reports that the attackers chained the login bypass with a separate privilege-escalation flaw. That flaw now has a patch (see the update above), so make sure it is installed.

If you think it was compromised

CISA points to Ivanti’s recovery procedure. In outline:

  1. Back up the appliance configuration.
  2. Factory reset the appliance and upgrade to the latest version. For virtual or cloud appliances, rebuild the instance and then upgrade.
  3. Restore the configuration from the backup.
  4. Reset passwords for all accounts (domain, administrator, and local), revoke and reissue certificates stored on the appliance, and reset stored API keys and license server credentials.

Volexity adds that attackers went after the VPN’s directory service account and domain secrets, including local administrator passwords managed by Windows LAPS and BitLocker recovery information. If your VPN could read those, rotate them too. Our Windows LAPS guide covers how that rotation works, and the incident response plan is a good place to track the steps.

Because this is a possible breach of a CJIS- or bank-connected network, confirm your reporting obligations with your CJIS Systems Agency, examiner, or counsel. This article does not decide that for you.

Reduce the risk next time

  • Keep the VPN’s management interface off the internet and limit who can reach it.
  • Send the appliance’s logs to a separate system, so an attacker who wipes local logs does not erase the evidence.
  • Use MFA for VPN sign-in and give the VPN’s directory account only the permissions it needs. See Meeting the CJIS MFA requirement on a small-agency budget.
  • Subscribe to the vendor’s security advisories and CISA’s KEV alerts so you hear about the next one the day it lands.

Sources

Facts here are as of October 13, 2026, with the November 2 update as noted.

All articles