Exploitation reportedSun, 1 Nov 2026
Ivanti Connect Secure exploited: patch VPN appliances and investigate access
Organizations using Connect Secure for VPN or remote access should verify appliance versions, preserve evidence and review connected identities and services.
Article
The Canadian Centre for Cyber Security reports that CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30, 2026. Separately, Ivanti’s CNA published CVE-2026-104935, an authentication bypass with a CVSS v3.1 base score of 8.6, on October 13. MITRE’s CNA scored CVE-2026-111357 7.0 under CVSS v3.1.
The Canadian advisory, updated October 30, lists releases prior to 25.1.1.3, 25.1.3.1 and 22.8R2.6 as affected in their respective branches. Check Ivanti’s guidance for the exact CVE and branch before selecting an update.
- 01
Reach the appliance
An attacker can reach a vulnerable remote-access appliance.
- 02
Cross the access boundary
Authentication bypass and other flaws may form part of an exploit chain.
- 03
Extend access
Unauthorized activity on the appliance may expose credentials, directory services or internal systems, depending on its privileges.
What to do: from the perimeter to internal systems
- 01
Inventory remote access
Include production, standby and managed appliances, their branches and identity dependencies.
See what to doResources: 1
TWISA member solutions
Inventory remote access
Include production, standby and managed appliances, their branches and identity dependencies.
- 02
Preserve evidence
Collect device and network logs and available volatile evidence under your incident response procedure. Look for unusual sign-ins and administrative actions.
See what to doResources: 1
TWISA member solutions
Preserve evidence
Collect device and network logs and available volatile evidence under your incident response procedure. Look for unusual sign-ins and administrative actions.
- 03
Apply the correct update
Follow vendor instructions for each branch. If evidence points to compromise, isolate and rebuild as appropriate. Review associated identities and rotate exposed credentials.
- 04
Verify recovery
Check remote access, failover and monitoring. Correlate VPN, directory and internal service logs.
See what to doResources: 1
TWISA member solutions
Verify recovery
Check remote access, failover and monitoring. Correlate VPN, directory and internal service logs.
Map remote access appliances, identities and the resources they can reach.
Allow authorized traffic and apply controls at each layer.
- 01
VPN entry
Public and management interfaces
Verify and patchMatch appliance versions to vendor guidance.
- 02
Appliance
Settings and logs
Preserve and investigateReview unusual activity before containment or recovery.
- 03
Identity and internal services
Directories, service accounts and business systems
Limit secondary impactReview access and rotate credentials as investigation findings warrant.
Feed logs and traffic data from each layer into monitoring and response.
- Monitoring and recoveryCorrelate VPN and identity events, and confirm service and failover after remediation.
Test and verify
Use authorized asset discovery, vulnerability scans, penetration and API testing, and attack simulation as appropriate. Retest patched appliances and verify segmentation, identity controls and monitoring. For any separate web path protected by a WAF, verify the request, alert, block and backend outcome independently.
TWISA member solutions
Inventory remote access
Include production, standby and managed appliances, their branches and identity dependencies.
Preserve evidence
Collect device and network logs and available volatile evidence under your incident response procedure. Look for unusual sign-ins and administrative actions.
Verify recovery
Check remote access, failover and monitoring. Correlate VPN, directory and internal service logs.
Sources and further reading
- Canadian Centre for Cyber Security advisory
- CVE Program: Ivanti CNA record for CVE-2026-104935
- CVE Program: CVE-2026-111357 and exploitation status
- Read the full article in Traditional Chinese
Alert updated: 2026/11/02. Check the vendor’s latest guidance for product support and patch status.