Ivanti Connect Secure vulnerability CVE-2026-111357: exploited chain, install 25.1.1.3 or 22.8R2.6

The short answer: the Ivanti Connect Secure VPN is the target of an exploited chain of three flaws. CVE-2026-104935, an authentication bypass leading to command execution, was fixed on 13 October 2026. On 29 October, Ivanti fixed the other two links, CVE-2026-111357 (privilege escalation to root) and CVE-2026-118527 (file upload to a predictable location). CISA added them to its catalogue of exploited vulnerabilities on 30 October. If your gateway runs 25.1.1.2 or 22.8R2.5, the versions rushed out in mid-October, it is still vulnerable: move to 25.1.1.3 or 22.8R2.6, then check that it has not been compromised.

In Morocco, Connect Secure (formerly Pulse Secure) is still found in organisations that deployed it for remote work or contractor access. Here is what the vendor, CISA, the researchers at Volexity and Morocco’s maCERT (DGSSI) say, and what to do about it.

What is affected

Product	Affected versions	Fixed version
Ivanti Connect Secure 25.1.1.x (ISA6000, ISA8000)	25.1.1.2 and earlier	25.1.1.3
Ivanti Connect Secure 22.8	22.8R2.5 and earlier	22.8R2.6 (or migrate to 25.1.1.3)
Ivanti Connect Secure 25.1.2.x	25.1.2.2 and earlier (CVE-2026-104935)	25.1.3.0 or 25.1.3.1
Ivanti Connect Secure 25.1.3.0 and later (ISA4500, ISA6500, ISA8500)	not affected according to Ivanti	no action for this alert
Ivanti Connect Secure 22.7.X and earlier	not affected according to Ivanti	plan migration (end of life on 31 January 2027)

Source: Ivanti security advisory 000109571, updated on 29 October 2026. Fixes are downloaded from the Ivanti licensing portal (ILS).

The three flaws, as published by Ivanti:

• CVE-2026-104935: authentication bypass by spoofing (CWE-290), allowing a remote unauthenticated attacker to execute commands. CVSS score 8.6 (high).
• CVE-2026-111357: missing authentication for a critical function (CWE-306, CWE-862, CWE-345), allowing a local authenticated attacker to escalate privileges. CVSS score 8.8 (high).
• CVE-2026-118527: predictable filenames (CWE-340), allowing a remote authenticated attacker to upload a file with attacker-controlled content to a known location. CVSS score 4.3 (medium).

On their own, the last two require prior access. Chained with CVE-2026-104935, they give remote, unauthenticated command execution according to CISA, with credential theft and data exfiltration.

Severity and exploitation

• Confirmed exploitation: Ivanti says it is aware of exploitation affecting a limited number of customers when the three flaws are chained.
• CISA KEV catalogue: CVE-2026-104935 has been listed since 13 October; CVE-2026-111357 and CVE-2026-118527 were added on 30 October 2026, with deadlines of 2 and 13 November for US federal agencies. CISA requires forensic triage for CVE-2026-111357.
• maCERT: bulletin 69521410/26 of 14 October rates CVE-2026-104935 critical in both risk and impact. At the time of this alert, we found no dedicated maCERT bulletin for the two flaws fixed on 29 October.
• What Volexity observed: on a gateway that was up to date at the time (22.8R2.4), the attacker gained root, extracted the Active Directory credentials used by the VPN, searched for LAPS passwords and BitLocker recovery keys, captured LDAP traffic and ran password-spraying attacks. The attacker then wiped traces from the appliance logs.

Interim measures, if the update has to wait

Ivanti publishes no workaround: updating is the only fix. Until the maintenance window:

1. Back up the gateway configuration before any change.
2. Restrict access to the admin interface to the management network only.
3. Watch the Active Directory service account used by the VPN: any unusual LDAP query or connection attempt to other servers should trigger an investigation.
4. Prepare what comes next: the 25.1.3.0 branch requires the new ISA4500, ISA6500 or ISA8500 appliances, or a new virtual machine template. This project needs planning before the 31 January 2027 end of life.

Checks to carry out

• Confirm the version actually running on every node, including standby and disaster recovery gateways.
• Do not rely on the Integrity Checker Tool alone: the attack changes memory, not disk. Ivanti points to the indicators published by Volexity, which include a hidden /data/.icscap/ directory, a dsstatmond process capturing traffic, Python scripts in /tmp/ and requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header.
• Review the internal network: unusual LDAP or Kerberos connections from the VPN’s internal address, and series of failed logins across many accounts.
• If in doubt, follow the CISA procedure: back up the configuration, factory reset and update the appliance (rebuild the instance for virtual or cloud versions), restore the configuration, then reset domain, administrator and local passwords, revoke and reissue stored certificates, and renew API keys.

Our take for businesses in Morocco

A VPN gateway is a direct entry point to the directory and the servers. This case shows two traps: an update applied once in a hurry, and trust in a checking tool that cannot see an in-memory attack. It is also a reminder that a VPN bound to the directory with an over-privileged service account exposes the whole domain.

To go further, read our guide to business VPN, IPsec and ZTNA, our patch management method, our first-hour incident response plan and our advice on multi-factor authentication. For the organisations concerned, law 05-20 and DGSSI requirements mean these bulletins must be acted on, and managed EDR with 24/7 monitoring helps spot lateral movement from the VPN.

How we can help

We check the version of your remote access gateways, plan the update, look for the published indicators and secure the service accounts tied to the directory. If moving to another remote access solution is on the table, we study it with you. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes. See our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Ivanti Connect Secure security advisory (CVE-2026-104935, updated 29 October), CISA KEV catalogue, CISA alert on Ivanti Connect Secure, maCERT: bulletin 69521410/26, NVD CVE-2026-111357, NVD CVE-2026-118527, Volexity.