Ivanti Connect Secure Zero-Day Chain (October 2026)
In October 2026, a chain of vulnerabilities in Ivanti Connect Secure was exploited in the wild, allowing unauthenticated attackers to achieve root-level command execution on affected appliances. The chain involves CVE-2026-104935 (authentication bypass leading to command execution), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (predictable file upload location). All three were added to the CISA Known Exploited Vulnerabilities catalog.
Affected versions and fixes
Affected versions include Connect Secure 22.8R2.5 and earlier and 25.1.1.2 and earlier. Fixed versions are 22.8R2.6 and 25.1.1.3 (or later). Exploitation was observed on fully patched appliances before the October fixes, and the attack chain did not require the installation of a traditional web shell.
Recommendations
- Upgrade all affected Connect Secure appliances to a fixed version.
- Perform forensic review of any appliance that was internet-exposed and unpatched during early-to-mid October 2026.
- Rotate credentials that were accessible from the appliance (including Active Directory credentials if the appliance was integrated).
- Do not rely solely on integrity checkers; the observed activity left limited on-disk artifacts.
This post is for awareness only and does not include exploit details.