Executive summary
Rapid7's 2 November investigation says the October updates for Ivanti Connect Secure's original authentication-bypass vulnerability do not fix two additional flaws used in the same intrusion chain. Its account identifies CVE-2026-111357 and CVE-2026-118527, reports that fixes are available, and recommends emergency remediation rather than waiting for a normal patch cycle. Rapid7
The response is broader than installing the first October update. TIR assessment — likely (B2): administrators need to verify the release against the complete chain and investigate whether the appliance was already compromised. Closing an entry route does not establish that credentials, sessions or attacker-installed components have been recovered.
What changed
Rapid7 reports that Ivanti expanded its advisory on 29 October and that the additional vulnerabilities were exploited before disclosure against a limited number of customers. Its investigation relates them to CVE-2026-104935, the previously disclosed authentication-bypass issue. These are linked weaknesses with different prerequisites; describing every component as an unauthenticated remote-code-execution vulnerability would lose that distinction. Rapid7
According to the report, CVE-2026-111357 permits privilege escalation by a local authenticated attacker. CVE-2026-118527 permits an authenticated remote attacker to place attacker-controlled content at a known location. Initial access and the resulting escalation must be assessed as a chain rather than by reading either flaw's individual severity as the complete outcome.
Rapid7 attributes observed unauthenticated root access to Volexity's investigation of the cluster UTA0576, beginning on 3 October against an appliance running 22.8R2.4. That is the reported start of one observed activity sequence, not a population-wide dwell-time estimate. The report also describes credential theft and directory queries relating to Windows Local Administrator Password Solution passwords and BitLocker recovery keys. It does not establish that every affected customer experienced those actions. Rapid7
Which update matters
The table below reproduces Rapid7's account of the relevant vendor release guidance. Administrators should match their exact deployment and hardware to Ivanti's advisory before an upgrade.
| Release family | Additional flaws remain in | Reported fixed version |
|---|---|---|
| 25.1 | 25.1.1.2 and earlier | 25.1.1.3 |
| 22.8 | 22.8R2.5 and earlier | 22.8R2.6 |
Rapid7 says the 13 October fixes in 25.1.1.2 and 22.8R2.5 address the original flaw but not these two additions. It reports Ivanti's recommendation to move from 22.8.X to 25.1.1.3 or later, with 22.8R2.6 available when migration cannot immediately be completed. Hardware and release exceptions should be checked against the vendor's current product guidance rather than generalised from this two-row summary. Rapid7
Severity figures also need their source. Rapid7 reports an Ivanti score of 8.8 for CVE-2026-111357, while noting that the CVE record and Rapid7's own database give 7.0 because they use different attack-complexity and scope assumptions. That disagreement is not evidence that the exploitation report is less urgent. The reported combined outcome is the reason to prioritise investigation.
Investigation and containment
Rapid7 warns that the observed activity can evade Ivanti's Integrity Checker Tool. A clean result therefore cannot be treated as proof that the appliance was never compromised. Preserve available memory and logs before a reboot or reset where feasible, and follow the vendor's recovery procedure if compromise is suspected. Rapid7
Useful investigation leads include abnormal web-request routing, unexpected temporary files or processes, and evidence of selective log deletion. Review records alongside approved administration and maintenance. A suspicious filename without its surrounding activity is a lead rather than a complete intrusion finding, while missing logs may reflect either attacker action or ordinary retention limitations.
TIR recommends scoping the identities and secrets reachable through the appliance. If the investigation establishes credential exposure, coordinate rotation and review downstream authentication. Do not assume that updating the VPN terminates every already-issued session or removes access established through stolen credentials. These are defensive implications of the reported chain, not a claim that every customer has a compromised directory.
Evidence limits
This article reports Rapid7's published investigation and its attribution of vendor and incident-response findings. It does not claim an independently measured victim count, a newly discovered exploit by TIR or a universal recovery procedure. The relevant distinction is between the date the investigation was announced, the earlier exploitation it describes, and the date an organisation completes verified recovery.
