Ivanti Connect Secure Zero-Days: Update Again and Investigate
Contents8
Attacks on the VPN device Ivanti Connect Secure used three vulnerabilities in combination. A new fix was released on 29 October, and on 30 October the US agency CISA added two of them to its list of vulnerabilities known to be exploited in real attacks.
The important point is that companies that finished updating in mid-October need to update again. This attack also leaves few traces, so updating alone does not let you say "we were not broken into". We go through it step by step, so that even a company that doesn't know who manages its VPN can follow along.
Key takeaways
- 25.1.1.3 or 22.8R2.6 is the version that fixes all three vulnerabilities.
- If you installed them in October, 25.1.1.2 / 22.8R2.5 are not enough. Update again.
- Ivanti's checking tool (ICT) cannot find this attack. Even if it says "no problems", you cannot relax.
- Some records disappear on an update or reboot, so save logs and memory first if you can.
3
Vulnerabilities used in combination
root
Highest privilege, taken without logging in
3 October
Start of the attacks confirmed by Volexity
Terms used here
VPN = a way to connect safely to the company network from outside. It is used for remote work and for links between offices.
Ivanti Connect Secure = a VPN device for businesses. It used to be called "Pulse Connect Secure".
root = the highest privilege on a device, which allows any operation.
Active Directory (AD) = a system for managing a company's accounts and computers in one place.
What is the attack, and why does it matter?
According to Volexity, which investigated, the attackers used three weak spots in sequence. Each one on its own needs certain conditions, but chained together they mean the highest privilege on the VPN device can be taken without logging in. Damage was confirmed even on devices running what was then the latest version.
| CVE number | Weak spot |
|---|---|
| CVE-2026-104935 | Attackers can slip past the login check and run programs |
| CVE-2026-118527 | Using a predictable number, attackers can place files in a location of their choosing (Ivanti rates it 4.3) |
| CVE-2026-111357 | Attackers can raise their privileges to the highest level inside the device (Ivanti rates it 8.8) |
A VPN device is the entrance to your company network. If it is taken, the damage does not stop at the device. The following activity has been reported in this attack.
Password theft
The attackers extracted internal account information stored on the device, and also collected it from network traffic.
Probing the internal network
They searched Active Directory for computer administrator passwords and disk encryption recovery keys.
Erasing traces
They did not plant malware, ran only in memory, and deleted the relevant parts of the logs.
"No problems" from the checking tool does not mean you are safe
Ivanti's checking tool (Integrity Checker Tool, ICT) looks for changes to the files on the device. According to Volexity, this attack leaves no files behind, so ICT cannot detect it. To find out whether you were broken into, you need to examine network traffic and memory.
On the scale of the damage
Ivanti says "a limited number of customers" were hit, and Volexity has confirmed one affected organisation. The identity of the attacker (known as UTA0576) is unknown. As far as we could confirm, at the time of this article we found no public report of damage in Japan.
Affected versions and where to move
| Current version | Status | Where to move |
|---|---|---|
| 25.1.1.1 and older | Hit by all 3 | 25.1.1.3 or later |
| 25.1.1.2 | 2 still open | 25.1.1.3 or later |
| 25.1.2.2 and older | Affected | Check the latest version in Ivanti's official guidance |
| 22.8R2.4 and older | Hit by all 3 | 25.1.1.3 or later (if that is difficult, 22.8R2.6) |
| 22.8R2.5 | 2 still open | 25.1.1.3 or later (if that is difficult, 22.8R2.6) |
※ Ivanti recommends moving from the 22.8 branch to 25.1.1.3 or later, and points to 22.8R2.6 for those who cannot move right away. Reports say no workaround has been given, and updating is the way to fix it.
※ Reports differ in how they describe the 25.1.2 and 25.1.3 branches. Always check Ivanti's official advisory.
Timeline
- Start of the attacks confirmed by Volexity. Another research firm reports activity from 1 October
- Ivanti discloses CVE-2026-104935 and releases a fix. CISA adds it to its list of exploited vulnerabilities the same day
- Ivanti releases 25.1.1.3 / 22.8R2.6, fixing the remaining 2 vulnerabilities
- CISA adds 2 of them to its list of exploited vulnerabilities
Six steps to check and respond
- Find out what VPN device you have
Ask your in-house IT staff or your network maintenance vendor. Purchase documents for the device, the maintenance contract, and the name of the connection app your staff use (Ivanti Secure Access, Pulse Secure and so on) are also clues.
- Check the version
Check the version on the device's admin screen and compare it with the table above.
- Save records before updating
The security firm Rapid7 recommends saving memory and logs before any reboot or reset, if possible. This keeps the material for an investigation from being lost.
- Update to the latest fix
Don't wait for your usual update day. Treat it as urgent work.
- Look for signs of an intrusion
Volexity recommends checking for large numbers of requests to
/dana-na/auth/url_default/welcome.cgiand for traces inside/tmp/. Examining network traffic and memory takes specialist knowledge. - If anything looks wrong, rotate passwords and keys
Follow Ivanti's recovery procedure, and replace VPN and Active Directory passwords, computer administrator passwords (LAPS), BitLocker recovery keys and so on.
What to ask your maintenance vendor
If you have outsourced the management of your VPN device, check the following.
- What is our VPN device? What version is it on now?
- Is it on a fix from 29 October or later (25.1.1.3 / 22.8R2.6)?
- Did you save logs and memory before updating?
- Besides the checking tool (ICT), did you also check network traffic and logs?
- Is the VPN device's admin screen set up so it cannot be opened from the internet?
In Japan, damage from attacks on entry points other than VPNs is also continuing. See also "Cyber Incidents in Japan, October to November 2026". If you can't reach your maintenance vendor, "Taking Over a Legacy System With No Documentation" may help.
Leave it, or act now?
If you leave it
- Weak spots stay open at the entrance to your company network
- Internal accounts can be stolen and damage can spread across the company
- Few traces remain, so you may notice too late
If you update and check for traces
- The three weak spots used in combination are fixed
- You can act early, if there was an intrusion
- You can tell partners it has been dealt with
How Digi Dinos can help
Digi Dinos is a software company with offices in Vietnam and Japan. Over 8 years we have delivered more than 150 projects. Our team works in Japanese.
- Review of your internal systems: we sort out what devices and systems you use and who maintains them.
- Taking over maintenance of existing systems: PHP, Java, Node.js, Python, .NET and more.
- Responding to new vulnerabilities: when a fix like this one comes out, we assess the impact and apply it.
- No documentation? No problem: even when the original vendor is gone and nobody understands the system, we read the code, rebuild the documentation and propose a complete plan.
- Lifetime warranty: if a defect turns up in work we did, we fix it, with no time limit for as long as the maintenance contract continues.
Not sure your VPN is safe? Free consultation.
We guide you in Japanese on where to start checking, even if you can no longer reach your maintenance vendor.
Frequently asked questions
We updated in October. Are we done?
If you are still on the 13 October fix (25.1.1.2 / 22.8R2.5), you are not done. The remaining 2 vulnerabilities are not fixed, so update to 25.1.1.3 or later, or to 22.8R2.6.
The checking tool (ICT) found no problems. Are we safe?
We can't say for certain that you are safe. This attack is reported to leave no changes to files, so ICT does not find it. Check logs and network traffic as well.
We are not a large company. Will we be targeted?
Devices reachable from the internet are searched for automatically, regardless of company size. The current reports are of attacks on a limited number of organisations, but if the attack method spreads, the number of targets could grow.
Should we switch to something other than a VPN?
There is no need to decide right away. First finish this update and these checks. After that, it is enough to consider it over the medium to long term, based on whether you can keep maintaining the device and how many people use it.
Sources
- Ivanti, "Security Advisory: Ivanti Connect Secure (CVE-2026-104935)"
- Volexity, "A Series of Unauthenticated Events" (13 October 2026)
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (30 October 2026)
- SecurityWeek, "Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain" (2 November 2026)
- Cyber Daily, "Patch now! Ivanti updates security advisory for trio of exploited vulnerabilities"
- Singapore CSA, "Active Exploitation of Vulnerability in Ivanti Connect Secure"
Related articles
WordPress CVE-2026-119977: Listed as Exploited, Update Now
Japan Data Breaches, Oct–Nov 2026: What Companies Should Check
GitLab CVE-2026-97229 (CVSS 10): Exploited, Patch Now
Linux Kernel Fragnesia (CVE-2026-46300): Exploited, Patch Now
Brotli Vulnerability CVE-2026-111497 (HTTP2Shell): What to Do
PHP Vulnerability CVE-2026-109618 (PHP2shell): What to Do Now
PHP Upgrade Cost: Moving From PHP 5 or 7 to PHP 8
Taking Over a Legacy System With No Documentation
Node.js Security Release, October 2026: What to Do
Java Vulnerabilities, October 2026: IPA Alert and Licence Changes
Securing Legacy Systems: Where to Start (2026 EOL Guide)
Superior Features of ChatGPT 4o (4 Omni)
What Is Digital Transformation? Definition, Roadmap and Examples
The Secret to Happiness!
What Is an IT Comtor? Role, Skills and How It Differs from a BrSE
