Patched Your Ivanti VPN on Oct. 13? Patch Again: A Weekend Checklist for Ivanti Connect Secure

If your office connects remote staff through an Ivanti Connect Secure VPN (the product many people still call Pulse Secure), the patch you installed in mid-October isn't the end of it. On Oct. 30, 2026, CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities list. Together with a bug fixed on Oct. 13, they form an attack chain that, in Volexity's words, gives an attacker "unauthenticated root-level code execution" on the VPN box. Ivanti shipped the last fixes on Oct. 29.

This matters for law and accounting firms, medical groups, manufacturers and any small business that bought an Ivanti or Pulse VPN years ago and hasn't thought about it since. The attackers in this case didn't come for the VPN. They came for the passwords that pass through it.

What's been reported

Three bugs, one chain. CVE-2026-104935 (CVSS 8.6) lets an outsider get past the VPN's login and run commands; Ivanti fixed it on Oct. 13 and CISA listed it that day. CVE-2026-111357 (CVSS 8.8) turns that foothold into full control of the appliance, and CVE-2026-118527 (CVSS 4.3) lets an attacker write files to a known place on its disk. The Hacker News reports both newer flaws are fixed in 25.1.1.3 and 22.8R2.6.
Ivanti patched in two steps on purpose. Ivanti told The Hacker News it had the Oct. 13 fix ready and chose "to not delay getting a fix to customers" while it finished the second one. That's why an appliance patched on Oct. 13 (25.1.1.2 or 22.8R2.5) still needs another update.
What the attackers did. Volexity, which found the attacks, says a previously unknown group it calls UTA0576 began exploiting the chain on Oct. 3 against a VPN that was fully patched at the time. From the VPN, it pulled the domain password the appliance uses to talk to Active Directory, searched for local administrator passwords and BitLocker recovery keys, tried password spraying and stole limited directory data. Volexity rates its own guess that the group is criminal rather than espionage as "low confidence."
It cleans up after itself. Volexity says the group left no backdoor, ran its tools in memory and deleted log entries. CISA warns that Ivanti's Integrity Checker Tool "may not detect evidence of exploitation" and that proving a break-in takes network and memory forensics.
The scale is limited so far. Ivanti says it's aware of exploitation affecting "a limited number of customers," according to Red Tiger Security's summary of the advisory. No small business has been publicly named.
Deadlines. CISA's KEV catalog gives federal agencies until Nov. 2 for CVE-2026-111357, and flags it for forensic checks as well as patching. CVE-2026-118527 is due Nov. 13. Those dates bind agencies, not you, but they show how seriously CISA rates this.

Why a small office should care

A VPN appliance sits at the edge of your network and checks every remote login against your Windows domain. If someone controls it, they can read the account it uses for those checks and watch the passwords going by. In Volexity's case, the next targets were the keys that unlock laptops and the local administrator passwords on every PC. That's the setup for a much bigger break-in.

One wrinkle on versions: CISA's updated alert also lists 25.1.2.2 and earlier as affected, and Canada's Cyber Centre lists versions before 25.1.3.1. If your appliance runs anything in the 25.1.2 or 25.1.3 line, have your IT provider confirm the right upgrade with Ivanti support rather than guess.

Clear takeaway

If you run Ivanti Connect Secure, get it on 25.1.1.3 or 22.8R2.6 (or a newer release Ivanti confirms is fixed) this weekend, even if you patched on Oct. 13, and if it faced the internet before that update, change the passwords it touches.

What to do this weekend

Find out what VPN you have. Ask your IT provider whether your remote access runs through Ivanti Connect Secure or an older Pulse Secure box, including a virtual or cloud copy.
Get the exact version in writing. 25.1.1.2, 22.8R2.5 or anything older still needs the new update.
Upgrade now. Move to 25.1.1.3, 22.8R2.6 or a newer release Ivanti says is fixed. Plan ahead for the 22.8 line: CISA notes it reaches end of life on Jan. 31, 2027.
Don't lean on the built-in checker. A clean Integrity Checker result doesn't prove the box is clean. Ask whoever manages it to review logs stored off the appliance for unusual connections from the VPN into your office network since early October.
Change the passwords it touches. If the VPN was reachable from the internet before you upgraded, reset the service account it uses to check logins against Active Directory, plus admin passwords. CISA's recovery steps also call for revoking and reissuing the appliance's certificates and resetting stored API keys.
Follow Ivanti's recovery steps if anything looks off. CISA's summary: back up the configuration, factory-reset and upgrade (or rebuild a virtual appliance), restore the configuration, then reset passwords.
Shrink the blast radius. Require multi-factor sign-in for every VPN user, give the VPN's service account only the access it needs, and make sure laptop BitLocker keys and local admin passwords aren't readable by that account.

How Brotherly Technology can help

Brotherly Technology can identify your VPN and its version, schedule the update after hours, review logs for signs the box was used against you, and rotate the domain and admin passwords it touches. If your remote access runs on Ivanti or an old Pulse Secure appliance and nobody's sure who maintains it, call us and we'll check it this weekend.