Ivanti VPN Flaws Are Being Chained to Steal Your Domain Credentials
If your business runs an Ivanti Connect Secure VPN, check it today. Attackers are chaining three flaws to get root on the appliance, then quietly helping themselves to your domain credentials.
On 30 October, CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities list, joining an authentication bypass listed on 13 October. Researchers report that an actor tracked as UTA0576 chains all three to get root without logging in. It then goes after credentials, Active Directory data and BitLocker recovery keys rather than dropping obvious malware.
The three flaws are CVE-2026-104935 (an authentication bypass, the way in), CVE-2026-118527 (predictable identifiers that let attackers upload files to a known location) and CVE-2026-111357 (missing authentication that escalates to root). They affect Connect Secure 25.1.1.2 and earlier, and 22.8R2.5 and earlier. One report names 25.1.1.3 and 22.8R2.6 as the fixed builds, but sources differ, so confirm against Ivanti's advisory.
Why this matters for Australian businesses
Patching is the easy part. This actor steals credentials and leaves, so a patched box can still sit in front of a domain whose passwords are already gone. We'd also put regional offices in Orange, Bathurst and Dubbo near the top of the list: one VPN appliance often fronts the entire network there, and it's rarely looked at after install.
There's a second trap. Fixing only the authentication bypass leaves the other two flaws open, so a half-patched appliance is still a way in.
What to do about it
- Upgrade to the latest fixed release. Confirm the build number against Ivanti's advisory first.
- Export the appliance logs somewhere else before you upgrade. An upgrade or reset can wipe the evidence.
- Rotate credentials. That means the LDAP/AD bind account, appliance and domain admin passwords, VPN user passwords and any BitLocker keys stored in the directory.
- Run Ivanti's integrity checker, and consider a full rebuild if anything looks off.
Ivanti Connect Secure Exploit Chain CVE-2026-104935: UTA0576 Credential Theft Campaign, Aviatrix, 31 October 2026
Frequently Asked Questions
Is patching Ivanti Connect Secure enough?
No. The reported attacker steals credentials rather than leaving obvious malware, so a patched appliance can still sit in front of a domain whose passwords are already compromised. Patch, then rotate credentials and review logs.
Which Ivanti Connect Secure versions are affected?
Reporting lists 25.1.1.2 and earlier, and 22.8R2.5 and earlier, as affected. Always confirm exact versions against Ivanti's own security advisory before you upgrade.
What credentials should we rotate?
At minimum: the appliance admin passwords, the LDAP/Active Directory bind account, domain and server admin passwords, VPN user passwords, and any BitLocker recovery keys stored in the directory.
Does the 2 November CISA deadline apply to Australian businesses?
The deadline binds US federal agencies only, but it signals how urgent the issue is. Australian businesses running Connect Secure should treat it as a patch-now item.
Not sure what your VPN is running?
If nobody can tell you the model, version and credential setup behind your remote access, let's find out together before the next advisory lands.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →