If your business uses an Ivanti Connect Secure VPN appliance (formerly Pulse Secure) so staff can reach the office network from home or the road, please make sure it gets this week's update. Security firm Volexity found attackers chaining three flaws in Connect Secure that, together, let someone on the internet with no username or password run commands on the appliance with full control. Ivanti fixed the first flaw on October 13, 2026 and the last two on October 29. On October 30, CISA added those last two to its list of vulnerabilities known to be exploited.
The short version: update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6 (or later) now. If the appliance was on an older version this month, have it checked for signs of compromise and change the passwords it stores.
What the flaws do
The three flaws are tracked as CVE-2026-104935 (an authentication bypass that lets an attacker run commands), CVE-2026-111357 (lets that access be raised to full administrator, or root, control) and CVE-2026-118527 (lets an attacker place files of their choosing on the appliance). Volexity first saw the chain used in early October against an appliance that was fully up to date at the time.
According to Volexity and CISA, the attacker focused on stealing passwords and data. Volexity says they pulled domain credentials stored on the VPN for LDAP sign-ins, searched Active Directory for local administrator passwords and BitLocker recovery keys, and looked through sign-in logs for valid usernames. CISA notes that Ivanti's Integrity Checker Tool may not detect this activity, because the attacker's commands run in memory.
Who is at risk
- Ivanti Connect Secure appliances, physical or virtual, on version 25.1.1.2 or earlier, or 22.8R2.5 or earlier, for the two flaws fixed October 29.
- For the first flaw (CVE-2026-104935), Ivanti's advisory says versions 22.7R2.14 and earlier are not affected. Check Ivanti's advisory for your exact version.
- CISA notes that Connect Secure version 22.8 reaches end of life on January 31, 2027, and Ivanti recommends moving 22.8 appliances to the 25.1 line.
What to do now
- Update the appliance. Install 25.1.1.3 or 22.8R2.6, or a later release, from Ivanti's download portal. Plan a short maintenance window, since remote users will be disconnected during the update.
- If the appliance ran an older version this month, have it checked. CISA says confirming a compromise takes network and memory forensics. If anything looks wrong, CISA's recommended recovery is to back up the configuration, factory reset and update the appliance (or rebuild a virtual one), then restore the configuration.
- Reset the passwords the VPN knows about. If a compromise is suspected, CISA recommends resetting passwords for all accounts, including domain, administrator and local accounts, and reissuing stored certificates and API keys. The domain account the VPN uses for LDAP sign-ins is a good place to start.
- Keep watching sign-ins. Look for unusual VPN logins, password-spraying attempts and new activity from the VPN appliance toward other servers on your network.
Questions to ask your IT provider
- Do we have an Ivanti Connect Secure (or older Pulse Secure) VPN, and which version is it running?
- Has it been updated to 25.1.1.3 or 22.8R2.6 or later?
- Was it on an affected version this month, and has anyone reviewed it and the accounts it stores?
Not sure whether your Ivanti VPN is on a fixed version, or whether it was touched before the update? We can check your appliance version, apply the update, and review it for signs of trouble. Call 713.980.2000 or send us a note.
Let's Talk →