The VPN that passed its own health check

The VPN that passed its own health check

Killswitch Issue #2 covers the Ivanti Connect Secure (ICS) zero-day chain tracked as CVE-2026-104935 and CVE-2026-111357 [1][5][6]. The appliance at the centre of it was fully patched, and Ivanti’s own Integrity Checker said it was clean, while an attacker held root on it [1]. Hence the title.

The attacker got root on the edge with no web shell and no file changes, then went after Active Directory: LAPS admin passwords, BitLocker recovery keys and service-account credentials [1]. Facts are as of 28 Oct 2026, and this is a defensive briefing with no exploit code.

Fully patched. Integrity check clean. Still owned.

Picture the box that lets your staff work from home. From at least 3 Oct until the 13 Oct disclosure, someone had root on a fully patched ICS appliance like that. They left no malware behind, re-ran the exploit for every command and edited the logs as they went [1]. Volexity documented three zero-days chained into unauthenticated root [1].

Shadowserver tracked 5,600+ internet-exposed hosts with ICS fingerprints on 14 Oct, a count that may include honeypots and already-patched hosts [7]. Because nothing changed on disk, the Integrity Checker saw nothing. Both CISA and Volexity say confirming a compromise needs network and memory forensics [1][3].

An unknown actor rooted Ivanti VPNs and went straight for Active Directory

Volexity tracks the actor as UTA0576. It chained an authentication bypass (welcome.cgi), a file-write remote code execution flaw (wu.cgi) and a privilege escalation to root on ICS 22.8R2.4 [1]. Ivanti tracks the bypass and RCE together as CVE-2026-104935, CVSS 3.1 8.6, and says it is aware of exploitation “affecting a limited number of customers” [2][5][9]. CISA added it to KEV on 13 Oct, with a federal due date of 16 Oct [3][4].

The root escalation, CVE-2026-111357 (CVSS 3.1 7.0, local), is recorded as exploited in the wild in October 2026. As of 28 Oct we could not find a fixed release for it, and it was not in KEV [1][2][4][6]. Volexity assesses with low confidence that the motive is criminal, and with medium confidence that the actor used large language models to build the exploit and run post-exploitation activity [1].

Two weeks from first exploitation to a published root bug

Ivanti says it had already fixed “a portion of this vulnerability” in 25.1.3.0 in July [2][9]. Defused, as reported by BleepingComputer, saw its first sign of in-the-wild exploitation on 1 Oct [7]. UTA0576 began repeatedly exploiting the chain against a Volexity customer on 3 Oct, and Volexity opened its investigation on 5 Oct [1]. On 13 Oct came Ivanti’s advisory and fixed builds, Volexity’s write-up and the KEV listing [1][2][3][4][5].

On 14 Oct Belgium’s CCB warned to patch immediately [10]. CVE-2026-111357 was published on 15 Oct [6], and the Canadian Cyber Centre noted on 16 Oct that it is exploited [8]. By 28 Oct it still had no identified fix and was not in KEV [2][4][6]. The ICS 22.8 and 22.7 code lines reach end of life on 31 Jan 2027 [3][10][13].

Check your version today

Affected: Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier [3][10]. Fixed for CVE-2026-104935: 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, and Ivanti recommends moving to the 25.x line [2][13]. 22.7R2.14 and earlier are not affected by 104935 [2][5], but that line still reaches end of life on 31 Jan 2027 [10].

Hardware, virtual and cloud instances are all in scope. Anyone running ICS for remote access should care, especially where the appliance has an Active Directory service account for LDAP authentication: that account is how the attacker reached the directory [1]. Version wording differs between sources, and we use the CISA and CCB wording [3][8][10].

URL says “public”, header says “go here”

Defender’s view only, no exploit code. First, front-door confusion: a public login script decides whether a request is allowed based on the URL, while a request header decides where it actually goes, so naming a protected script in that header reaches it without authentication [1]. Second, a race: an upload handler writes the file to disk before checking that it is a valid ZIP, and the attacker hits it in that brief window [1].

Third, borrowing a root service: the attacker patches an Ivanti library in memory, redirects a root maintenance task in DSCache, asks dsinvoked to run it, then puts everything back [1]. Finally, clean-up every time: the chain re-runs for every command, results come back over HTTPS, and selected entries are removed from the Ivanti debug log and the Linux audit log [1][3]. Nothing changes on disk.

Identity, not the VPN

Once in, the attacker read stored LDAP credentials and the ICS configuration, queried Active Directory for LAPS passwords, BitLocker recovery keys and password-bearing attributes, and ran password spraying and Kerberos credential tests from the appliance [1]. They also parsed packet captures for plaintext LDAP, HTTP Basic and NTLM material [1].

Volexity read this as preparation for lateral movement [1]. The final objective is unknown because the intrusion was disrupted [1]. Our read: the VPN is the door but identity is the prize, so rotating the credentials the appliance could reach matters as much as the patch.

Hunt where the attacker can’t edit the logs

In web traffic, look for lots of requests to /dana-na/auth/url_default/welcome.cgi, or an X-DSCGI-PATH header that doesn’t match the URL path; Volexity warns attackers may find other paths [1]. On the appliance, look for unexpected files in /tmp/, a hidden .icscap directory or a renamed packet-capture tool. From the appliance to AD, look for the VPN service account searching for LAPS, BitLocker or password attributes, and spraying or Kerberos activity from the VPN’s internal IP [1].

The attacker filtered log entries rather than wiping files, so look for gaps in the ICS debug log or audit log, not for empty logs [1]. Volexity published the network IOC 108.165.147[.]64, an Evoxt VPS, with more indicators on its GitHub [1]. Killswitch recommendation: ship appliance logs off-box (ISO/IEC 27001 8.15) [12], and don’t rely on the Integrity Checker alone [1][3].

Patch, hunt, then rotate

Find every ICS appliance, hardware, virtual and cloud, and record its version [3]. Upgrade to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5 as a stop-gap, and plan the move to 25.x before 31 Jan 2027 [2][13]. Assume the privilege escalation is still open and watch Ivanti’s advisory for the CVE-2026-111357 fix [1][6]. Hunt back to at least 1 Oct 2026 [1][7].

Our recommendations, based on the data Volexity says was targeted [1]: rotate the VPN’s AD service account, the LAPS-managed local admin passwords and the BitLocker recovery keys that account could read; make sure it can’t read LAPS or BitLocker attributes at all; and stop plaintext LDAP to the appliance, since credentials were harvested from captured port-389 traffic.

Ivanti recovery steps, as summarised by CISA

If you suspect a compromise, follow Ivanti’s recovery steps as summarised by CISA [3]: back up the configuration, factory reset the appliance (or rebuild virtual and cloud instances) and upgrade, then restore the configuration from the backup.

Then reset all passwords, domain, admin and local; revoke and reissue stored certificates; and reset API keys and licence-server credentials [3]. CISA’s alert is the authoritative text. Confirming a compromise needs network and memory forensics, not the Integrity Checker alone [1][3], so keep the memory images as incident evidence (ISO/IEC 27001 control 5.28) [12].

Edge-device zero-days are a governance test

Under NIS2 [11], Article 21(2)(e) covers vulnerability handling, so KEV-listed edge flaws should have a defined, fast patch SLA. Article 21(2)(b) and (d) cover incident handling and supply-chain security: your VPN vendor is a supplier risk, and CISA lists 36 Ivanti CVEs in KEV, the earliest added 3 Nov 2021, 12 of them marked as used in ransomware [4][7]. Article 23 starts the clock when you become aware of a significant incident: early warning in 24 hours, notification in 72 hours, final report within one month [11].

In ISO/IEC 27001:2022 Annex A [12], 8.8 makes KEV a priority feed; 8.15 and 8.16 cover off-box logging, which matters because this attacker edited local logs; 5.24–5.28 cover incident management and evidence; 5.17 and 8.2 cover service-account scope; and 5.19–5.22 put the 22.x end of life into your supplier risk register. The board-level question: if our remote-access appliance were compromised today, could we tell, and which credentials would we rotate?

What we don’t know yet

As of 28 Oct 2026 there was no confirmed fixed release for CVE-2026-111357, and it was not in CISA KEV. Its CVE record lists only 22.8R2.4 as affected; whether 25.x builds are affected is “unknown” [6]. Ivanti’s own advisory, read on 28 Oct, covers only CVE-2026-104935 and does not mention 111357 [2].

No victim count has been published beyond Ivanti’s “a limited number of customers” [2][9]. Shadowserver’s 5,600+ hosts may include honeypots and already-patched hosts [7]. The criminal motive is a low-confidence assessment and the final objective is unknown [1]. KEV lists ransomware use for CVE-2026-104935 as “Unknown” [4]. And the Canadian Cyber Centre lists “25.2.2 and prior” where CISA and CCB list “25.1.2.2 and prior” [3][8][10].

Turn this issue into owners, decisions and evidence

An edge-device zero-day needs an owner, a decision and evidence: patched, hunted, credentials rotated, and the 22.x end of life planned. GRCompliance tracks risks, suppliers and evidence against ISO 27001 and NIS2 in one place. Try the live demo at demo.grcompliance.com, or self-host GRCompliance Core free from GitHub.

Subscribe free at killswitch.work to get every Killswitch issue with its slide deck. To go deeper on cloud security and supplier risk, Sectutor has books and kits from the author of the CCSP Excellence books, including the CCSP Kit and Single Point of Failure: Managing Europe’s Dependence on US Technology. Not investment, legal or audit advice.

Next steps

About the author. Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.

Sources

1. Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (13 Oct 2026). www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
2. Ivanti — Security Advisory, Ivanti Connect Secure (CVE-2026-104935). hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
3. CISA — CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (13 Oct 2026). www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
4. CISA — Known Exploited Vulnerabilities Catalog (lists CVE-2026-104935, added 13 Oct 2026, due 16 Oct 2026; CVE-2026-111357 not listed as of 28 Oct 2026). www.cisa.gov/known-exploited-vulnerabilities-catalog
5. CVE record CVE-2026-104935 (CNA: Ivanti). www.cve.org/CVERecord?id=CVE-2026-104935 · nvd.nist.gov/vuln/detail/CVE-2026-104935
6. CVE record CVE-2026-111357 (CNA: MITRE, published 15 Oct 2026). www.cve.org/CVERecord?id=CVE-2026-111357 · nvd.nist.gov/vuln/detail/CVE-2026-111357
7. BleepingComputer — CISA warns admins to immediately fix Ivanti flaw exploited as zero-day (14 Oct 2026). www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/
8. Canadian Centre for Cyber Security — Ivanti security advisory AV26-1035, Update 1 (16 Oct 2026). www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035
9. The Register — Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks (14 Oct 2026). www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095
10. Centre for Cybersecurity Belgium — Warning: Actively Exploited Zero-Day Vulnerability in Ivanti Connect Secure… (14 Oct 2026). ccb.belgium.be/advisories/warning-actively-exploited-zero-day-vulnerability-ivanti-connect-secure-allows-remote
11. Directive (EU) 2022/2555 (NIS2), Articles 21 and 23. op.europa.eu/en/publication-detail/-/publication/9b84d482-85bd-11ed-9887-01aa75ed71a1
12. ISO/IEC 27001:2022. www.iso.org/standard/27001
13. Ivanti — October 2026 Patch Tuesday blog. www.ivanti.com/blog/october-2026-patch-tuesday

Facts as of 28 Oct 2026. Not legal advice. Killswitch is a defensive briefing: no exploit code, and every claim links to its source. Lines marked “our read” or “our recommendation” are Killswitch analysis, not source text. Not investment or audit advice either.