Your VPN Is Compromised. Your Security Tool Won't Tell You. The Ivanti Triple-Chain Attack Explained.

When organizations think about VPN security, they tend to think about the perimeter - keeping unauthorized users out. What makes this week's Ivanti Connect Secure attacks so troubling is that they make the perimeter itself the attack vector.

Three vulnerabilities, chained together, give attackers unauthenticated remote code execution on Ivanti Connect Secure SSL VPN appliances. No valid account required. No password needed. Just access to a VPN device that's sitting at the edge of your network - where it's supposed to be - waiting to be exploited.

And here's the part that should concern every business leader: Ivanti's own Integrity Checker Tool doesn't detect this compromise. So if you patched, ran the checker, and got a clean result, you still can't be confident your environment is clean.

What Actually Happened

CISA added two new Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30: CVE-2026-111357, a missing authentication flaw (CVSS 8.8) that allows privilege escalation, and CVE-2026-118527, a predictable identifier vulnerability (CVSS 4.3) that enables remote authenticated file upload to a known location.

Both are being chained with a third flaw, CVE-2026-104935 - an authentication bypass and remote code execution vulnerability that CISA added to KEV back on October 13.

Together, these three vulnerabilities create a complete attack chain: bypass authentication entirely, execute code remotely, escalate to root. No account. No password. Root access on your VPN appliance.

Volexity researchers discovered the active exploitation campaign in mid-October, attributed to a threat actor tracked as UTA0576. Once inside the VPN appliances, the attackers weren't deploying ransomware or doing anything loud. They were being quiet and methodical: stealing credentials, querying Active Directory for Windows LAPS passwords, harvesting BitLocker recovery keys, and preparing for lateral movement deeper into the network.

The patience is significant. These weren't smash-and-grab attacks. UTA0576 was building a foundation for something larger.

Why the Integrity Checker Problem Matters

Most organizations, when they hear about a critical VPN vulnerability, have a response plan: patch the device, run the integrity checker, verify clean, move on.

Volexity's report breaks that assumption. The compromise evades Ivanti's Integrity Checker Tool. A clean result does not mean a clean system.

This creates a significant risk for any organization that applied patches and assumed the checker's clean result was a reliable signal. It isn't. If UTA0576 or another actor was in your environment between October 13 (when CVE-2026-104935 became public) and whenever you patched, the integrity checker won't tell you.

Rapid7 and Volexity both recommend a more rigorous response: preserve memory and logs before rebooting or resetting the device. Investigate for compromise regardless of what the checker reports. Rotate every credential that may have been visible from the VPN appliance - including Windows LAPS passwords and anything stored in Active Directory.

This is a meaningful amount of work. But it's the right amount of work for a compromise of this severity.

CISA's Federal Mandates - And What They Mean for Your Organization

CISA has mandated that US federal civilian agencies address CVE-2026-111357 by November 2, 2026 - yesterday - and CVE-2026-118527 by November 13. Federal agencies also have to conduct forensic triage and investigate for possible compromise, not just patch.

Federal mandates don't apply to private companies. But the federal response protocol is informative: it treats this as a compromise-has-occurred scenario requiring investigation, not just a patch-and-move-on situation.

If your organization runs Ivanti Connect Secure - especially versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, or 22.8R2.5 and earlier - Ivanti has issued patches for all three vulnerabilities. Applying those patches is the immediate priority.

But patching alone is not sufficient. The federal protocol tells you why.

Three Questions for Business Leaders

You may or may not run Ivanti Connect Secure specifically. But this attack illustrates a pattern that applies to any organization with VPN infrastructure:

When did you last audit who has access to your VPN management interfaces?

VPN appliances are perimeter devices. They sit at the network edge and have privileged access to everything inside. Their management consoles should be treated as high-value targets - restricted access, MFA required, logs actively monitored. If your VPN management is accessible from the internet or protected only by a password, that's the same exposure profile that made these attacks possible.

What credential inventory lives on or near your VPN infrastructure?

In this attack, the goal wasn't just appliance access - it was credential harvest. Windows LAPS passwords. BitLocker recovery keys. Active Directory data. The VPN appliance was a platform for accessing everything downstream. If your VPN device can reach sensitive credential stores or directories, an attacker who owns the VPN appliance effectively owns a path to everything it can touch.

What is your actual detection capability for compromised infrastructure?

Vendor-provided integrity checkers are useful tools. They are not substitutes for independent forensic capability. The Ivanti case makes explicit something that security professionals have known for years: compromise detection requires more than running the vendor's own health check. Outbound traffic analysis, memory forensics, log aggregation, and third-party endpoint detection all matter - especially in the hours and days before patches are applied.

The Broader Pattern

Ivanti Connect Secure has appeared in CISA's KEV catalog repeatedly over the past two years. It's not that Ivanti is uniquely insecure - network edge devices broadly have become a primary target for sophisticated threat actors. VPN appliances, firewalls, and load balancers operate with elevated privileges, are internet-facing by design, and are often excluded from standard endpoint monitoring because they run proprietary operating systems.

That combination - internet-facing, privileged, under-monitored - makes them valuable targets. Nation-state actors and sophisticated criminal groups have noticed.

The operating assumption for any organization with edge network devices should be: these devices are actively targeted. They require patch urgency beyond what you apply to internal systems, dedicated monitoring, and periodic third-party assessment.

If your VPN was unpatched while these exploits were in the wild, treat your environment as potentially compromised until you've completed the investigation protocol - not the integrity check, the actual investigation.

TrustPoint Cyber helps organizations assess and respond to network infrastructure compromise. If you're uncertain where to start, the investigation protocol is where we begin.