What happened
On 13 October 2026, Ivanti released fixes for CVE-2026-104935 in 25.1.1.2 and 22.8R2.5, but those builds remained affected by CVE-2026-111357 and CVE-2026-118527. On 29 October 2026, Ivanti added fixes for CVE-2026-111357 and CVE-2026-118527 in 25.1.1.3 and 22.8R2.6. On 30 October 2026, CISA added CVE-2026-111357 and CVE-2026-118527 to KEV; the federal due dates are 2 November 2026 and 13 November 2026 respectively. CISA says affected versions include 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. Rapid7 lists 25.1.1.3 and 22.8R2.6 as the fixed releases for CVE-2026-111357 and CVE-2026-118527.
Volexity observed exploitation beginning on 3 October 2026 against a then-fully-patched 22.8R2.4 Build 19097 appliance. The combined chain produced unauthenticated root-level command execution, after which the actor collected credentials, queried internal directory data, sprayed passwords and manipulated logs. The operational conclusion is that an appliance patched only to the first October release may still require another update and a compromise assessment.
Observed request patterns used /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH values /home/webserver/htdocs/dana/fb/smb/wu.cgi and /home/runtime/tmp/<MD5(filename)>. Rapid7 lists evidence files ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json under /tmp/, and identifies 108.165.147[.]64 as an exploitation IP reported by Volexity.
Volexity found anti-forensic deletion from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, and says the Ivanti Integrity Checker Tool may not detect the in-memory chain. The actor searched for LAPS passwords, BitLocker recovery keys and credential-bearing Active Directory attributes. Attribution posture: Volexity tracks the observed actor as UTA0576 but has not linked it to a named government or criminal group.
Why this matters now
The Friday change is not simply another CVE disclosure. It changes the status of builds that many teams may have deployed after the original October alert. An appliance on 25.1.1.2 or 22.8R2.5 can be fixed for the original bypass yet remain exposed to the additional chain components, so ticket closure based on the first upgrade is unsafe.
Connect Secure occupies a privileged network-edge position and handles authentication flows into internal estates. Volexity observed root-level execution, credential collection, Active Directory queries, password spraying and log manipulation. The in-memory technique also weakens a common assurance mechanism because the Integrity Checker Tool may not identify compromise.
The immediate executive choice is sequencing. Evidence collection may be destroyed by rebooting, but leaving an exposed appliance online extends risk. Incident response, network operations and identity owners need an approved plan that preserves memory and logs where feasible, isolates exposure, upgrades, and rotates reachable trust material.
The decision for security leaders
Direct incident response and network operations to approve a preserve-isolate-upgrade sequence for each appliance. Patch deployment alone cannot resolve whether the appliance was exploited before the update, particularly where volatile evidence and selectively deleted logs are central to the forensic record.
Reopen any October remediation ticket closed on 25.1.1.2 or 22.8R2.5. Require exact-build validation, exposure history, hunt results and a documented decision on credential rotation. Treat an Integrity Checker pass as one input, not as proof that the device was uncompromised.
Evidence of closure
- The asset register proves no appliance remains on an affected build.
- Authenticated validation records the fixed release on every appliance and cluster node.
- A preserved forensic package has an approved incident-response disposition.
- Hunt results cover the published paths, files, logs and exploitation IP.
The Security.io assessment
Confidence is high that the chain was exploited and that additional fixes are required because CISA, Ivanti, Volexity and Rapid7 align on the central facts. The material uncertainty is victim breadth: public evidence describes limited observed exploitation rather than a complete count of compromised appliances.
The risk is driven by privileged placement and evidentiary weakness, not the individual CVSS scores. An internet-facing authentication gateway that can yield root access, expose directory secrets and erase local traces warrants incident handling even when vulnerability management reports a completed patch.
Questions for the morning meeting
- Can the organisation identify every Connect Secure appliance, exact build and exposure window?
- Was volatile evidence preserved before any reboot, reset or upgrade?
- Which credentials, certificates and API keys were accessible from each appliance?
- Can the incident owner prove that a clean Integrity Checker result was not treated as closure?