CVE-2026-111357 & CVE-2026-118527: Ivanti Connect Secure Zero-Day Exploitation — Emergency Detection and Remediation Guide

Introduction

On October 30, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) Catalog. This designation confirms that threat actors are actively exploiting these flaws in the wild, posing an immediate and severe risk to federal networks and private enterprises alike.

The vulnerabilities — CVE-2026-111357 (Missing Authentication for Critical Function) and CVE-2026-118527 (Generation of Predictable Numbers or Identifiers) — represent a dangerous combination that can allow unauthenticated attackers to bypass security controls and gain initial access to VPN concentrators. Ivanti Connect Secure appliances serve as critical perimeter devices, often exposing administrative interfaces to the internet. Compromise of these systems provides adversaries with a foothold for lateral movement, data exfiltration, and persistent access to internal networks.

Binding Operational Directive (BOD) 26-04 mandates that Federal Civilian Executive Branch (FCEB) agencies prioritize remediation of KEV-listed vulnerabilities based on risk. Given the active exploitation status, organizations treating Ivanti Connect Secure as a trusted boundary device must assume breach and initiate immediate threat hunting alongside patching operations.

Technical Analysis

Affected Products and Vulnerability Details

CVE-2026-111357: Missing Authentication for Critical Function

This vulnerability allows remote, unauthenticated attackers to access restricted functionality on Ivanti Connect Secure appliances without providing valid credentials. The flaw resides in improper access control mechanisms within the web service architecture, where specific administrative or API endpoints fail to enforce authentication checks before processing sensitive requests.

From a defensive perspective, this means attackers can interact with critical system functions — potentially including configuration management, user session handling, or diagnostic interfaces — without possessing valid VPN credentials. The exposure of such endpoints to untrusted networks (particularly the internet) transforms this from a configuration weakness into a full remote code execution or authentication bypass vector when chained with other flaws.

CVE-2026-118527: Generation of Predictable Numbers or Identifiers

This vulnerability involves the use of insufficiently random values in security-critical contexts. In VPN concentrators, predictable identifiers often manifest in session tokens, CSRF tokens, or cryptographic nonces. When these values become predictable, attackers can:

• Session Fixation/ Hijacking: Guess valid session identifiers to impersonate authenticated users.
• Token Prediction: Forge password reset tokens or temporary authentication codes.
• Cryptographic Weaknesses: Undermine the integrity of encrypted communications if nonces or initialization vectors are predictable.

Attack Chain Implications

While CISA has not publicly detailed the specific chaining methodology, the combination of missing authentication (CVE-2026-111357) and predictable identifiers (CVE-2026-118527) creates a high-probability attack path:

1. Initial Access: An unauthenticated attacker leverages CVE-2026-111357 to reach vulnerable administrative functions.
2. Privilege Escalation/ Persistence: Using CVE-2026-118527, the attacker predicts session tokens or cryptographic keys to maintain access or elevate privileges.
3. Network Pivot: With control of the VPN concentrator, the adversary gains visibility into decrypted traffic or uses the device as a launchpad for internal reconnaissance.

Exploitation Status

Both vulnerabilities are confirmed as actively exploited in the wild. Inclusion in the CISA KEV Catalog is not based on theoretical risk or proof-of-concept availability — it is a direct response to observed exploitation by malicious cyber actors. Organizations operating Ivanti Connect Secure should treat this as an incident, not merely a patching exercise.

Detection & Response

Given the network appliance nature of Ivanti Connect Secure, detection strategies must focus on anomalous administrative access, unexpected process execution on the appliance, and suspicious network indicators. If your Ivanti appliances log to a SIEM (via Syslog/CEF), or if you have endpoint detection on management workstations interacting with these devices, the following rules and queries provide immediate hunting value.

Sigma Rules

---
title: Ivanti Connect Secure Suspicious Process Execution
id: 8b7c9d2e-4f5a-4b6c-9d8e-1a2b3c4d5e6f
status: experimental
description: Detects unusual process spawning or command execution on Ivanti Connect Secure appliances, which may indicate post-exploitation activity following CVE-2026-111357 exploitation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    exe:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
      - '/usr/bin/nc'
      - '/bin/netcat'
  condition: selection
falsepositives:
  - Legitimate administrative maintenance scripts
  - Automated backup or monitoring agents
level: high
---
title: Ivanti Connect Secure Web Server Anomalous Access
id: 9c8d7e6f-5a4b-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects access attempts to sensitive Ivanti Connect Secure administrative endpoints that may indicate exploitation attempts targeting CVE-2026-111357.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/admin/'
      - '/api/'
      - '/dana-na/'
      - '/rest/'
    cs-method: 'POST'
  filter:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate external administrative access (should be rare and verified)
  - Vulnerability scanners (verify source IP)
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for suspicious network connections and authentication anomalies on Ivanti Connect Secure devices
// Requires Syslog/CEF ingestion from Ivanti appliances into Sentinel

let TimeRange = 24h;
CommonSecurityLog
| where TimeGenerated > ago(TimeRange)
| where DeviceVendor == "Ivanti" or DeviceProduct contains "Connect Secure"
| where DeviceEventClassID contains "auth" or DeviceEventClassID contains "admin"
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172."
| summarize Count = count(), DistinctDestinations = dcount(DestinationIP) by SourceIP, DestinationIP, DeviceEventClassID, Message
| where Count > 5 or DistinctDestinations > 3
| order by Count desc;

// Detect potential session token prediction attempts
SecurityEvent
| where TimeGenerated > ago(TimeRange)
| where EventID == 4625 // Failed logon
| where IpAddress !startswith "10." and IpAddress !startswith "192.168."
| summarize FailedAttempts = count() by IpAddress, TargetUserName, LogonType
| where FailedAttempts > 10
| join kind=inner (
    SecurityEvent
    | where TimeGenerated > ago(TimeRange)
    | where EventID == 4624 // Successful logon
    | where IpAddress !startswith "10." and IpAddress !startswith "192.168."
) on IpAddress
| project IpAddress, FailedAttempts, TargetUserName, TimeGenerated;

Velociraptor VQL

-- Hunt for suspicious network connections and processes on Ivanti Connect Secure management hosts or adjacent systems
-- Deploy this artifact to endpoints with access to Ivanti management interfaces

SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    Netstat.LocalIP,
    Netstat.LocalPort,
    Netstat.RemoteIP,
    Netstat.RemotePort,
    Netstat.State
FROM pslist()
JOIN netstat() ON Pid = netstat().Pid
WHERE 
    (Name =~ 'ivanti' OR Name =~ 'connect' OR CommandLine =~ 'ivanti')
    AND Netstat.RemoteIP !~ '^(10\.|192\.168\.|172\.)'  // Non-RFC1918 remote connections
    AND Netstat.State == 'ESTABLISHED'
ORDER BY CreateTime DESC

Remediation Verification Script (Bash)

#!/bin/bash
# Ivanti Connect Secure CVE-2026-111357 & CVE-2026-118527 Remediation Verification Script
# Run this on Ivanti Connect Secure appliances or management jump boxes with SSH access

LOG_FILE="/var/log/ivanti_remediation_$(date +%Y%m%d_%H%M%S).log"

echo "=== Ivanti Connect Secure Security Verification ===" | tee -a $LOG_FILE
echo "Date: $(date)" | tee -a $LOG_FILE
echo "" | tee -a $LOG_FILE

# Check current software version
echo "[+] Checking Ivanti Connect Secure version..." | tee -a $LOG_FILE
VERSION=$(cat /etc/pulsesecure-version 2>/dev/null || cat /data/runtime/tmp/version 2>/dev/null || echo "Version file not accessible")
echo "Current Version: $VERSION" | tee -a $LOG_FILE

# Verify patch status (requires admin credentials via API or CLI)
echo "[+] Checking for installed patches..." | tee -a $LOG_FILE
if command -v /home/bin/integrity_checker &> /dev/null; then
    /home/bin/integrity_checker --status | tee -a $LOG_FILE
else
    echo "Integrity checker not found - verify manually via admin console" | tee -a $LOG_FILE
fi

# Check for unauthorized admin accounts
echo "[+] Auditing administrative accounts..." | tee -a $LOG_FILE
if [ -f /data/runtime/tmp/active_users ]; then
    cat /data/runtime/tmp/active_users | grep -i admin | tee -a $LOG_FILE
else
    echo "Active users file not accessible - check via admin web interface" | tee -a $LOG_FILE
fi

# Review recent authentication logs for anomalies
echo "[+] Checking recent authentication attempts..." | tee -a $LOG_FILE
if [ -f /var/log/auth.log ]; then
    grep -i "failed\|error\|invalid" /var/log/auth.log | tail -20 | tee -a $LOG_FILE
fi

# Network connection audit
echo "[+] Active network connections..." | tee -a $LOG_FILE
netstat -tuln 2>/dev/null | grep -E ':(443|8443|80|22)' | tee -a $LOG_FILE

echo "" | tee -a $LOG_FILE
echo "=== Verification Complete ===" | tee -a $LOG_FILE
echo "Review $LOG_FILE for findings"
echo ""
echo "IMMEDIATE ACTIONS REQUIRED:"
echo "1. Verify appliance is running patched version (see vendor advisory)"
echo "2. Review admin console for unauthorized configuration changes"
echo "3. Rotate all administrative credentials"
echo "4. Implement network ACLs restricting admin interface to management VLANs only"

Remediation

Immediate Actions (Within 24-48 Hours)

1. Apply Vendor Patches Immediately

   • Ivanti has released security updates addressing CVE-2026-111357 and CVE-2026-118527.
   • Action: Download and apply the latest Connect Secure firmware from the Ivanti Security Advisory portal.
   • Verification: Confirm patch installation via the admin console under System > Maintenance > Version or via CLI.

2. Restrict Administrative Interface Exposure

   • If the management interface is currently internet-facing, remove it immediately.
   • Implement firewall rules permitting administrative access only from dedicated management networks or jump boxes.
   • Disable any "Remote Management" features unless explicitly required and secured via VPN.

3. Credential Rotation

   • Reset all administrative passwords, API keys, and service account credentials on Ivanti Connect Secure devices.
   • If the device integrates with Active Directory or LDAP, consider resetting associated service accounts.

4. Integrity Verification

   • Run Ivanti's built-in Integrity Checker Tool to detect file system modifications.
   • Review running processes and network connections for indicators of compromise (IoCs).

CISA BOD 26-04 Compliance Deadlines

Under Binding Operational Directive 26-04, FCEB agencies must:

• Remediate KEV-listed vulnerabilities within 15 calendar days of inclusion for vulnerabilities with significant risk, or immediately if active exploitation is confirmed.
• Report completion through the Cybersecurity Compliance and Implementation System (CCIS) or agency-equivalent tracking mechanisms.
• Justify delays through formal risk acceptance processes only when compensating controls are implemented and documented.

Given the active exploitation status confirmed by CISA, agencies should treat this as an emergency change requiring out-of-band patching procedures.

Compensating Controls (If Immediate Patching Is Not Possible)

If patching cannot occur immediately:

• Isolate the Device: Place Ivanti Connect Secure behind a Web Application Firewall (WAF) with virtual patching rules blocking access to /admin/ and /api/ endpoints from untrusted sources.
• Enhanced Monitoring: Deploy full packet capture and netflow analysis on VPN concentrator traffic. Alert on any outbound connections from the appliance to non-corporate IP ranges.
• Micro-Segmentation: Limit the appliance's network access to only necessary internal resources (DNS, AD, logging servers). Block east-west traffic to critical servers.
• Disable Non-Essential Services: Turn off any unnecessary Ivanti features, particularly file sharing, endpoint compliance scanning, or third-party integrations.

Threat Hunting and Incident Response

Because these vulnerabilities are actively exploited, patching alone is insufficient. Assume breach and:

1. Review VPN Logs: Examine authentication logs for the past 30-90 days for anomalous source IPs, unusual session durations, or atypical user-agent strings.
2. Memory Forensics: If supported, capture memory images of running appliances before rebooting for patch installation.
3. Network Traffic Analysis: Look for DNS tunneling, unusual TLS certificate usage, or beaconing activity originating from the Ivanti appliance.
4. Lateral Movement Indicators: Audit internal systems for authentication attempts sourced from the VPN concentrator's IP address that deviate from baseline administrative patterns.

Vendor and Government Resources

• Ivanti Security Advisory: https://forums.ivanti.com/s/article/Security-Advisory-CVE-2026-111357-CVE-2026-118527
• CISA KEV Catalog Entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA BOD 26-04: https://www.cisa.gov/binding-operational-directive-26-04

Conclusion

The addition of CVE-2026-111357 and CVE-2026-118527 to the CISA KEV Catalog represents a critical inflection point for organizations relying on Ivanti Connect Secure. These are not hypothetical vulnerabilities — they are actively weaponized attack vectors targeting the integrity of your network perimeter.

Security teams must treat this as an ongoing incident rather than a routine patching event. Immediate remediation, coupled with aggressive threat hunting and credential rotation, is the only responsible course of action. The window between KEV inclusion and widespread exploitation is measured in hours, not days. Act now.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub