The third flaw in a chain, not a standalone bug
Ivanti disclosed CVE-2026-104935, an authentication bypass and remote code execution flaw in Connect Secure, as a standalone advisory. It turned out to be the first link in a chain. Researchers at Volexity found attackers pairing it with two additional zero-days: CVE-2026-111357, a missing authentication vulnerability that lets a local authenticated attacker escalate privileges, and CVE-2026-118527, a predictable-identifier flaw that enables remote authenticated file upload. Chained together, the three bugs gave attackers a path from unauthenticated access to root-level control of the appliance, all without ever touching a known signature that older detection tooling would flag.
CISA added the two newer CVEs to its Known Exploited Vulnerabilities catalog last Friday, which means they were already being used in the wild before the public disclosure caught up. The agency ordered federal civilian agencies to remediate CVE-2026-111357 by November 2, a deadline that has already passed, and gave until November 13 for CVE-2026-118527. For anyone keeping a rolling tally, this is the third Connect Secure zero-day chain to surface in Ivanti's product line this year, and the pattern of chaining rather than exploiting single bugs is becoming the default, not the exception.
Why your integrity checker will not save you
The detail that should change how security teams respond is Volexity's finding that the UTA0576 campaign evades Ivanti's Integrity Checker Tool, the utility organizations rely on to confirm an appliance has not been tampered with. Ivanti itself put it plainly: a clean result does not rule out compromise. That single sentence invalidates a step most incident response runbooks treat as a trust anchor. If your playbook says 'run the integrity checker, if it is clean move on,' that playbook is now wrong for this family of attacks, and you need a fallback that does not depend on a tool the attackers have already learned to walk past.
Rapid7's forensic findings explain why the stakes are higher than a typical VPN compromise. The attackers were not simply harvesting VPN credentials. They queried Active Directory for Windows LAPS passwords and BitLocker recovery keys, the exact material needed to move laterally into domain-joined endpoints and unlock encrypted drives. Volexity assesses with high confidence that this was preparation for broader compromise, and that the campaign was detected and disrupted before attackers reached their final objective. That is a narrow escape, not a resolved incident, for any organization running the affected appliances.
The patching decision is not the hard part anymore
Ivanti has shipped fixes for all three vulnerabilities, so the patch itself is not where this gets difficult. The hard part is the forensic triage CISA is also mandating alongside the patch: investigate for possible compromise before you assume the update closed the door. Rapid7's explicit recommendation is to check for signs of prior compromise after patching, not instead of it. If your team's instinct is to apply the update and move the ticket to done, that instinct is the gap attackers are counting on, especially given how long this activity appears to have run undetected by standard tooling.
The operational guidance worth following is preserving memory and logs before rebooting or resetting the appliance where feasible, since a reboot can erase the forensic trail you need to determine whether you were already compromised. Volexity has published indicators of compromise and YARA rules, and Ivanti has issued threat-hunting guidance alongside the patch. If compromise is confirmed or even suspected, rotate every credential the appliance could have touched, not just the VPN credentials. LAPS passwords and BitLocker keys exposed by this chain are exactly the kind of secondary blast radius that gets missed when teams treat VPN compromise as contained to the VPN.
The pattern across three Connect Secure chains this year
This is not an isolated incident in Ivanti's product history this year. Edge VPN appliances, the devices sitting at the network perimeter specifically to be internet-facing, have become the preferred foothold for sophisticated intrusion sets precisely because they are harder to instrument than endpoints and harder to take offline than a single server. Attackers who find a chain that evades integrity verification get a foothold that looks clean to the exact tool designed to catch it, which is a far more durable asset than a single unpatched CVE.
For CTOs and CISOs managing vendor risk, the question worth asking Ivanti and every other edge-appliance vendor is what evidence they have that their own verification tooling can now detect this family of attack. A vendor that ships a patch while leaving the integrity checker's blind spot unaddressed has closed the vulnerability while leaving the trust problem open. That trust problem is the one your board will ask about if this appliance sits in your environment and a breach surfaces six months from now that traces back to a foothold nobody's tooling caught. Ask the vendor now, in writing, rather than waiting for the postmortem to raise it for you.
What this means for your patch governance
If Connect Secure sits anywhere in your environment, whether as a primary remote access tool or a legacy appliance nobody has gotten around to retiring, this is not a ticket you let sit in a sprint backlog. The combination of active exploitation, a KEV catalog entry, and a federal deadline is the signal CISA uses to flag the highest-confidence active threats it tracks, and private-sector security teams should treat that signal with the same urgency federal agencies are required to, even without the compliance mandate forcing the issue.
Build the forensic triage step into your patch rollout now, not as a follow-up project. Preserve logs, check Volexity's published indicators against your own appliance logs, and rotate the credentials this chain targets before you close the ticket. The organizations that get hurt worst by this kind of attack tend to be the ones that patched on time, declared the incident closed, and never checked whether the attacker had already been inside for months before the fix landed. Add a compromise-assessment line item to every edge-device patch cycle going forward, for this vendor and for every other appliance sitting at your network perimeter, and budget the analyst hours for it the same way you budget for the patch itself.
