Rapid7, KISA urge re-patching Ivanti Connect Secure after attacks

Rapid7 and KISA urged administrators of Ivanti Connect Secure to apply additional fixes beyond the patches released on October 13, after real-world attacks chaining zero-day flaws in the enterprise VPN product were confirmed. Both issued their guidance on November 2, according to dailysecu.com.

The attacks combine an authentication bypass tracked as CVE-2026-104935 with CVE-2026-111357 and CVE-2026-118527. The last two are a privilege escalation issue and a flaw that allows upload of attacker-controlled files to predictable paths. Chained with the authentication bypass, they permit code execution with root privileges without logging in.

Rapid7 advised urgent updating rather than waiting for a regular patch schedule. KISA recommended moving to version 25.1.1.3 or later, or 22.8R2.6 or later.

Earlier patches left gaps

Versions 25.1.1.2 and 22.8R2.5, released on October 13, do not address the two additional vulnerabilities, so organizations that updated then must re-check their installed versions. Ivanti updated its security advisory on October 29 and provided versions fixing the additional flaws.

Volexity confirmed that the group UTA0576 attacked version 22.8R2.4 starting October 3, stealing stored VPN credentials and querying Windows local admin passwords and BitLocker recovery keys from Active Directory.

Rapid7 also advised preserving memory and logs before rebooting or resetting, and rotating possibly exposed credentials.