Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

When we covered the Ivanti Connect Secure zero-days on October 14, one piece was still open. Attackers had chained three bugs to get root on the VPN appliance, and Ivanti had fixed only the first two. The third, the jump to root, now has a patch.

CISA added that root bug to its exploited list on Friday and gave federal agencies until today, Monday, November 2. If your remote access runs through Connect Secure, the upgrade you did in mid-October was not the last one.

The October upgrade closed the front door. This one closes the route to root, and CISA’s deadline for it is today.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Ivanti ships the missing root fix, and CISA lists it as exploited

On October 30 CISA added CVE-2026-111357 to the Known Exploited Vulnerabilities catalog with a due date of November 2, and marked forensic triage as required. It also listed a second Connect Secure bug, a lower-rated (CVSS 4.3) predictable-identifier flaw that lets a logged-in attacker write a file with chosen content to a known place on disk, due November 13. CISA says both chain with CVE-2026-104935, the authentication bypass Ivanti fixed on October 13.

Volexity, which found the attacks, updated its report to say Ivanti published the fix for the privilege escalation on October 29. The flaw sits in how the dsinvoked broker, a background service that runs maintenance tasks as root, trusts configuration data in DSCache. Volexity watched a group it tracks as UTA0576 use the full chain from October 3 on a box that was fully patched at the time, running 22.8R2.4.

The Hacker News reports the fixed releases as 25.1.1.3 for the 25.1.1 line and 22.8R2.6 for 22.8. Canada’s Cyber Centre also lists 25.1.3.1 among the fixed builds.

Who still runs an Ivanti VPN box that is open

Any Connect Secure appliance below those builds is exposed if its login page faces the internet. CISA’s updated alert names 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected by the chain. It also notes that the 22.8 line reaches end of life on January 31, 2027.

The root bug is what turned a web-level foothold into full control of the box. With it, UTA0576 pulled the LDAP credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran password spraying and parsed packet captures for logins. It deleted its own entries from the debug and audit logs and left no web shell, and Ivanti’s Integrity Checker Tool did not flag the changes.

Move to 22.8R2.6 or 25.1.1.3, then rotate what the box knows

• Find every Connect Secure appliance, including standby and lab units, and note the exact build.
• Upgrade to 22.8R2.6, 25.1.1.3 or 25.1.3.1 according to your branch, using Ivanti’s advisory and its 25.x upgrade guide.
• Rotate the Active Directory service account the appliance binds with, and any passwords, certificates and API keys stored on it, as CISA’s recovery steps list.
• If the box was reachable from the internet on an older build in October, follow CISA’s recovery order: back up the configuration, factory reset, upgrade, restore, then reset credentials.
• Ranking this against other open patches? Our patch priority checklist puts exploited, internet-facing appliances first.

Details

• CVE-2026-111357: privilege escalation to root through the dsinvoked broker’s trust in DSCache configuration data. The Hacker News reports Ivanti’s score as CVSS 8.8; the MITRE-issued CVE record scores it 7.0 and lists 22.8R2.4 as affected. KEV added October 30, 2026, due November 2, 2026, forensic triage required.
• Second KEV entry (October 30): predictable identifiers that let an authenticated attacker upload a file with attacker-controlled content to a known location on disk. CVSS 4.3, due November 13. CISA lists it on KEV; it had no published CVE.org record when we checked on November 1.
• Entry point: CVE-2026-104935, authentication bypass and code execution through welcome.cgi and wu.cgi, fixed October 13, KEV since October 13.
• Fixed builds: 22.8R2.6 and 25.1.1.3 (The Hacker News), plus 25.1.3.1 (Canadian Centre for Cyber Security). 22.8 end of life: January 31, 2027 (CISA).

Hunt / verify

• In web or WAF logs in front of the appliance, look for bursts of requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that points somewhere other than the URL, such as wu.cgi or /home/runtime/tmp/.
• In Active Directory, check LDAP queries from the appliance’s service account for LAPS and BitLocker attributes, and failed-login bursts sourced from the appliance’s internal address.
• Look for traffic to 108.165.147[.]64, the host Volexity tied to UTA0576. A clean Integrity Checker result does not rule out a break-in; Volexity and CISA say memory and network forensics are needed.

Source: CISA KEV addition, October 30; Ivanti advisory

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 30, 2026)
• CISA: CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (revised October 30, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Ivanti: Security Advisory, Ivanti Connect Secure (CVE-2026-104935)
• Volexity: A Series of Unauthenticated Events, Chained Exploitation of Ivanti Connect Secure Zero-Days (updated)
• The Hacker News: Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
• Canadian Centre for Cyber Security: Ivanti security advisory (AV26-1035), Update 2
• NVD: CVE-2026-111357

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].