Ivanti Connect Secure Flaws Trigger Federal Remediation Orders

Last updated: November 3, 2026

Two actively exploited Ivanti Connect Secure vulnerabilities have been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. Federal civilian agencies now face separate remediation deadlines, while also conducting forensic triage for possible compromise.

Ivanti has released fixes for the flaws. Customers outside the federal government should not wait for CISA to act because the vulnerabilities were used in an attack campaign that turned affected VPN appliances into footholds inside targeted networks.

• CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog.
• Federal agencies must address CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13.
• Both vulnerabilities were exploited alongside CVE-2026-104935, an authentication-bypass and remote-code-execution vulnerability.
• The attackers harvested authentication material and searched Active Directory for stored Windows account and disk-encryption recovery secrets.
• Ivanti says all three flaws are fixed and recommends applying its updates.

The three flaws belong to one attack chain

The two newly catalogued issues were exploited as zero-days alongside CVE-2026-104935. Their value to the attackers was therefore greater as part of a combined operation than as isolated appliance vulnerabilities.

CVE-2026-111357 is a missing-authentication flaw affecting a critical function. It allows a locally authenticated attacker to escalate privileges. Its November 2 deadline is the earlier of the two, and federal agencies must also conduct forensic triage and investigate for possible compromise.

CVE-2026-118527 concerns the generation of predictable numbers or identifiers and makes remote authenticated file upload possible. Federal agencies have until November 13 to remediate it.

The practical distinction matters: patching only the two newly catalogued flaws would leave CVE-2026-104935 as an unresolved risk. All three issues need to be closed. Patching also does not establish that an appliance was never accessed or that an attacker did not persist after the vulnerability was fixed.

The VPN became an entry point

Volexity researchers discovered the activity and reported it to Ivanti. According to their assessment, the attackers were covertly turning SSL VPN appliances into footholds in targeted organizations’ networks.

The operation was detected and disrupted before the researchers could determine the attackers’ ultimate objective. Volexity nevertheless assessed with high confidence that the activity signaled preparation for lateral movement and broader compromise of the victim network.

That changes the nature of the response. These are not merely vulnerabilities that need closing. They were used in an operation designed to use the VPN appliance as an entry point, with the credential activity indicating interest in deeper access rather than a contained appliance compromise.

Rapid7 researchers noted that the attackers collected authentication data and searched Active Directory for Windows LAPS account secrets and BitLocker recovery information. Those searches point toward an interest in identity and recovery material associated with Windows systems. The specific downstream objective remains unknown, but the evidence indicates preparation for wider access.

The implications are uncomfortable for every organization using the affected product. Patching closes known paths into the appliance. It does not remove persistence, invalidate stolen credentials or prove that the device was never touched.

Why a clean scanner result may not be enough

Ivanti warned that the observed attack activity evades its Integrity Checker Tool. A clean report from that utility therefore does not rule out compromise.

The company’s recovery guidance has a specific order of operations. Where feasible, administrators should preserve memory and logs before rebooting or resetting the appliance. That evidence may help investigators determine what changed, whether accounts were abused and whether an attacker left a foothold behind.

If compromise is suspected, organizations should follow Ivanti’s recovery steps and rotate potentially exposed credentials. Passwords and identity information associated with a potentially compromised environment should not be assumed safe merely because the original vulnerability has been patched.

For federal agencies, CISA’s directive adds another layer: remediation is not simply a ticket to close. The CVE-2026-111357 order includes forensic triage and an investigation for possible compromise. Organizations should document updates, retained evidence, credential rotation and any recovery actions.

A decision checklist for Ivanti Connect Secure owners

Use this sequence to determine whether the response is complete:

• [ ] Identify every affected Connect Secure deployment in the organization.
• [ ] Install Ivanti’s fixes for all three vulnerabilities and confirm the resulting versions.
• [ ] Preserve available memory and logs before rebooting or resetting, where feasible.
• [ ] Review authentication, configuration and system logs for suspicious activity.
• [ ] Determine whether the appliance interacted with Active Directory or BitLocker management systems.
• [ ] Follow Ivanti’s recovery guidance if compromise is suspected.
• [ ] Rotate potentially exposed credentials and investigate for lateral movement.
• [ ] Do not treat a clean Integrity Checker Tool result as proof that the appliance was uncompromised.

Organizations outside the federal sector do not have CISA’s mandatory deadlines, but they face the same technical risk. The prudent sequence is update, preserve evidence, assess compromise and recover.

What to watch next

Watch for exploitation of these flaws outside the environments already identified. Active exploitation can precede follow-on activity after attackers establish access, including credential abuse and movement across internal services.

CISA’s deadlines will also show whether remediation is being treated as a genuine security operation. The November 2 target for CVE-2026-111357 arrives first, but completing an update does not erase the need for forensic review.

Ivanti and the investigating researchers have shared indicators of compromise and YARA rules. Those resources will matter to organizations trying to distinguish this campaign from unrelated appliance activity. Until the investigation is complete, administrators should assume that affected appliances require both technical patching and compromise assessment.

Key takeaways

• Apply Ivanti’s fixes for all three vulnerabilities, not only the two newly catalogued flaws.
• Preserve logs and memory before rebooting or resetting an appliance where feasible.
• Do not rely on a clean Integrity Checker Tool result to exclude compromise.
• Rotate exposed credentials and investigate Active Directory and BitLocker interactions.
• Treat patching as the start of the response, not proof that the appliance was never compromised.