CVE-2026-111357 & CVE-2026-118527: Ivanti Connect Secure Zero-Days Exploited in the Wild — Detection and Remediation Guide

On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to disclose two additional vulnerabilities that are already being exploited in the wild. This is not another theoretical risk bulletin. According to Ivanti, exploitation has already occurred prior to disclosure against a limited number of customers when these flaws are chained together. One of the vulnerabilities, CVE-2026-118527, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active, real-world abuse.

For defenders, this is a familiar and uncomfortable pattern. ICS sits at the edge of the network as a VPN gateway, brokers authenticated access into internal environments, and historically has been a high-value target for both financially motivated actors and state-sponsored intrusion sets. When Ivanti discloses chained exploitation before broad public visibility, the operational assumption should be simple: internet-exposed ICS appliances may already be compromised, and patching alone is not enough.

This post breaks down what is known, how the flaws likely fit together, what defenders can hunt for today, and what immediate actions should be prioritized across vulnerability management, SOC, and incident response teams.

Technical Analysis

Affected Products and Platform

The impacted product is Ivanti Connect Secure (ICS), the company's SSL VPN / secure access platform commonly deployed as an edge gateway for remote access. While exact vulnerable version ranges should be confirmed directly against Ivanti's advisory, the operational takeaway is broader than a single build number: organizations running supported ICS instances should assume exposure until they validate both patch state and appliance integrity.

Vulnerabilities

CVE-2026-111357 — Missing Authentication for Critical Function (CWE-306)

• Ivanti CVSSv3.1: 8.8
• Impact: Allows a local authenticated attacker to escalate privileges.
• Defender significance: This is not the initial access vector in the public summary, but it is a powerful post-compromise primitive. Once an attacker obtains a foothold on the appliance or valid authenticated context, this flaw can be used to increase control over the device and expand the blast radius.

CVE-2026-118527 — Generation of Predictable Numbers or Identifiers (CWE-340)

• Ivanti CVSSv3.0: 4.3
• CISA KEV: Listed
• Impact: According to CISA's KEV entry, allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk.
• Defender significance: Even a lower-severity score becomes operationally important when the bug enables controlled file placement on an edge appliance. On VPN concentrators, file upload to predictable or known paths can be a stepping stone toward persistence, webshell deployment, configuration tampering, or follow-on privilege escalation when chained with another weakness.

How the Attack Likely Works

The public details indicate these issues are being chained. The phrase matters. Individually, each flaw has constraints. Together, they become much more dangerous.

A plausible defensive model of the attack chain looks like this:

1. Authenticated access is obtained or abused

   • The attacker either has valid credentials, hijacks an authenticated session, or leverages predictable identifiers generated by the vulnerable component.

2. CVE-2026-118527 enables attacker-controlled file placement

   • The attacker writes content to a known location on disk.
   • On an appliance like ICS, this can mean deployment of a webshell, malicious script, staged payload, or tampered component in a web-accessible or executable path.

3. CVE-2026-111357 is used to escalate privileges

   • Once code or command execution is achieved in a lower-privileged context, the missing authentication on a critical function allows privilege escalation.
   • This converts limited post-auth abuse into broader appliance control.

4. Persistence and follow-on activity

   • Typical ICS post-exploitation behavior includes credential theft, web shell installation, log tampering, configuration export, and internal reconnaissance from the VPN edge inward.

Exploitation Status

• Exploitation: Confirmed in the wild prior to disclosure
• Scale: Described by Ivanti as affecting a limited number of customers
• KEV Status: CVE-2026-118527 is in CISA KEV
• Defender posture: Treat this as active exploitation, not emerging risk

Why This Matters Right Now

Edge devices remain one of the most abused control points in enterprise environments because they are:

• Internet-facing by design
• Often poorly instrumented compared with endpoints
• Frequently excluded from traditional EDR coverage
• Operationally sensitive, which delays reboots, patching, and forensic collection
• Trusted by downstream authentication and access workflows

In practical IR terms, a compromised ICS appliance can become the launch point for credential harvesting, session theft, internal scanning, and unauthorized access to applications that would otherwise sit behind network boundaries. That makes this more than a VPN vulnerability story. It is an identity and intrusion pathway story.

Detection & Response

This is a technical threat with confirmed exploitation. Detection strategy should focus on three layers:

1. ICS-specific artifact review
2. Network and syslog telemetry from the appliance
3. Internal downstream activity originating from VPN infrastructure

Because ICS is not a general-purpose Windows endpoint, defenders should combine appliance log review with SIEM correlation and selective VQL hunts on systems that ingest or proxy relevant telemetry.

Sigma Rules

---
title: Suspicious File Write Activity on Ivanti Connect Secure Appliance
id: 9c4d2b7a-6f18-4d2a-9a66-7f1c8f51a901
status: experimental
description: Detects suspicious file creation or modification events involving web-accessible or script-related paths that may indicate attacker-controlled content upload on Ivanti Connect Secure appliances.
references:
  - https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/webserver/'
      - '/cgi-bin/'
      - '/perl/'
      - '/tmp/'
      - '/var/tmp/'
  filter_legit_admin:
    SourceImage|contains:
      - '/usr/bin/'
      - '/bin/'
  condition: selection and not filter_legit_admin
falsepositives:
  - Legitimate package updates or administrative scripting during maintenance windows
level: high
---
title: Ivanti Connect Secure Suspicious Child Process Execution
id: 7a2e94f1-58cc-48d9-b8d2-53d4c8f16b22
status: experimental
description: Detects unusual command execution spawned from ICS-related processes, which may indicate post-exploitation after web shell deployment or privilege escalation.
references:
  - https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'webserver'
      - 'httpd'
      - 'perl'
      - 'cgi'
      - 'ivanti'
      - 'pulse'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/chmod'
      - '/chown'
      - '/python'
      - '/python3'
      - '/openssl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative maintenance scripts executed under appliance operating procedures
level: high
---
title: Potential Privilege Escalation Activity on Ivanti ICS
id: 2cf7f3b6-9a12-45f8-9e83-91b1a2fd7a10
status: experimental
description: Detects command sequences associated with permission changes, file staging, and execution on Linux-based VPN appliances, which may reflect privilege escalation attempts tied to ICS compromise.
references:
  - https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'chmod +x'
      - 'chmod 777'
      - 'chown root'
      - '/tmp/'
      - '/var/tmp/'
      - 'setuid'
      - 'sudo '
  condition: selection
falsepositives:
  - Manual administrative remediation or package maintenance
level: medium

KQL Hunt Queries for Microsoft Sentinel / Defender

If your ICS logs are forwarded to Sentinel via syslog or CEF, hunt first for suspicious process execution and web request anomalies tied to file placement, command execution, or uncommon authenticated activity.

// Hunt for suspicious process execution reported by ICS-appliance syslog forwarding
Syslog
| where TimeGenerated >= ago(14d)
| where Computer has_any ("ivanti", "ics", "connect", "pulse") or HostIP has_any ("ivanti")
| where SyslogMessage has_any ("chmod", "wget", "curl", "/tmp/", "/var/tmp/", "webshell", "python", "bash", "sh -c")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;

// Hunt for suspicious file upload or write patterns in normalized network/security logs
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where DeviceVendor has_any ("Ivanti", "Pulse Secure") or DeviceProduct has_any ("Connect Secure", "ICS")
| where Message has_any ("upload", "write", "tmp", "cgi-bin", "webshell", "authenticated", "post")
| project TimeGenerated, SourceIP, DestinationIP, DeviceVendor, DeviceProduct, Message, RequestMethod, RequestURL
| order by TimeGenerated desc;

// Correlate VPN-edge IP addresses with suspicious downstream internal connections
let suspicious_window = 14d;
DeviceNetworkEvents
| where TimeGenerated >= ago(suspicious_window)
| where RemoteIP in (
    CommonSecurityLog
    | where TimeGenerated >= ago(suspicious_window)
    | where DeviceVendor has_any ("Ivanti", "Pulse Secure")
    | where Message has_any ("upload", "authenticated", "tmp", "cgi-bin")
    | summarize by tostring(DestinationIP)
)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort, InitiatingProcessName
| order by Connections desc;

Velociraptor VQL

Use VQL where you have collectors on management jump boxes, forensic acquisition hosts, or endpoint systems that may have staged appliance tooling, logs, or extracted ICS artifacts. For ICS itself, native appliance forensics will usually come first, but VQL is still valuable for hunting adjacent Windows/Linux systems used by administrators and attackers.

-- Hunt for suspicious files and command artifacts related to ICS compromise staging
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(ivanti|connect secure|/tmp/|/var/tmp/|curl |wget |chmod |chown |python|bash|sh -c)'
   OR Name =~ '(curl|wget|python|bash|sh|openssl)'

-- Hunt for recently created suspicious files in common staging and web-serving paths
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/tmp/*', '/var/tmp/*', '/**/cgi-bin/*', '/**/webserver/*'])
WHERE Mtime > now() - 1209600
   OR FullPath =~ '(webshell|payload|update|session|auth|ivanti)'

Practical SOC Triage Guidance

If you manage or monitor ICS appliances, prioritize the following immediately:

• Review authenticated administrative and user-level access for unusual source IPs, impossible travel, off-hours access, or previously unseen accounts.
• Search for unexpected file creation in temporary, web, and script execution paths.
• Look for unexpected outbound connections from the ICS appliance to rare external IPs or cloud-hosted staging infrastructure.
• Compare current appliance configuration and files against known-good baselines.
• Hunt for internal scanning or authentication attempts originating from the VPN gateway after suspicious appliance activity.
• Preserve logs before patching or rebooting if compromise is suspected. Forensic volatility on edge appliances is a real problem, and many teams destroy evidence unintentionally during remediation.

Remediation

1. Patch Immediately

Ivanti released fixes for both vulnerabilities on October 29, 2026. Apply the vendor-fixed versions referenced in the official Ivanti advisory without delay. Because exploitation predates disclosure, this should be handled as emergency change management, not routine patch cadence.

• Vendor advisory: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure
• Rapid7 analysis: https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

2. Do Not Assume Patch = Clean

For confirmed exploited zero-days, patching removes the vulnerable code path but does not remove webshells, implanted persistence, harvested credentials, or altered configurations. Every ICS appliance that was exposed and unpatched during the exploitation window should undergo compromise assessment.

At minimum:

• Capture current logs and configuration state
• Review authentication logs for suspicious sessions and account use
• Inspect file system artifacts where possible
• Validate integrity using vendor-supported methods
• Reset credentials that may have traversed the appliance
• Review certificates, local admin accounts, SSO integrations, and API tokens tied to the gateway

3. Reduce Attack Surface Now

If your organization cannot patch immediately, implement compensating controls while the maintenance window is being approved:

• Restrict ICS administrative interfaces to trusted management networks only
• Enforce IP allowlisting where operationally feasible
• Disable unnecessary features and portals
• Confirm MFA for remote access workflows
• Monitor for all new account creation and password resets
• Alert on any file upload behavior involving known executable or web-served paths

4. Review Authentication and Session Security

Because one of the disclosed issues involves predictable identifiers, defenders should pay close attention to how authenticated sessions are established and validated. Hunt for suspicious reuse, replay, or access from abnormal infrastructure immediately after valid authentication events.

Recommended actions:

• Invalidate active sessions after patching
• Force reauthentication for privileged access
• Rotate credentials associated with appliance management
• Review conditional access and IdP sign-in logs for anomalies
• Search for new remote access sessions originating from unusual ASN, hosting providers, or TOR/VPN infrastructure

5. Validate Internal Impact

If compromise is confirmed or strongly suspected, expand investigation beyond the appliance:

• Identify users who authenticated during the suspected compromise window
• Review downstream access to internal apps, file shares, RDP, SSH, and cloud consoles
• Look for Kerberos anomalies, NTLM relay patterns, new local admin creation, and abnormal service usage
• Hunt for webshell-like behavior on internal systems reachable through VPN access

6. CISA / Federal Remediation Expectations

Because CVE-2026-118527 is listed in CISA KEV, federal civilian agencies and organizations following Binding Operational Directive guidance should treat remediation as mandatory within the applicable KEV timeline. Private-sector organizations should use the same urgency standard regardless of formal obligation.

Verification Script

Use the following Bash snippet on Linux-based collection hosts or forensic jump boxes to organize log acquisition, search suspicious strings, and create a quick evidence bundle for review. Adapt paths to your environment and ensure evidence handling follows your IR procedures.

#!/usr/bin/env bash
set -euo pipefail

OUTDIR="/tmp/ics_ir_review_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

# Collect relevant syslog/auth artifacts if present on the analysis host
sudo cp /var/log/syslog* "$OUTDIR"/ 2>/dev/null || true
sudo cp /var/log/auth.log* "$OUTDIR"/ 2>/dev/null || true
sudo cp /var/log/messages* "$OUTDIR"/ 2>/dev/null || true

# Search for suspicious strings commonly associated with post-exploitation and staging
sudo grep -RniE 'ivanti|connect secure|pulse|cgi-bin|webshell|/tmp/|/var/tmp/|curl |wget |chmod |chown |python|bash|sh -c|upload' "$OUTDIR" > "$OUTDIR/suspicious_hits.txt" || true

# List recently modified files in likely staging locations
find /tmp /var/tmp -type f -mtime -14 -ls > "$OUTDIR/recent_tmp_files.txt" 2>/dev/null || true

# Save package/process/network context from the review host
ps auxww > "$OUTDIR/processes.txt"
ss -tulpn > "$OUTDIR/listening_sockets.txt" 2>/dev/null || netstat -tulpn > "$OUTDIR/listening_sockets.txt" 2>/dev/null || true

# Create archive for handoff to IR
tar -czf "${OUTDIR}.tar.gz" -C /tmp "$(basename "$OUTDIR")"
echo "Evidence bundle created: ${OUTDIR}.tar.gz"

Executive Takeaways

• Patch ICS immediately using the vendor-released fixed builds.
• Treat this as an incident, not a routine vulnerability, because exploitation occurred before disclosure.
• CVE-2026-118527 is in CISA KEV, which materially raises urgency and should drive leadership escalation.
• Assume identity risk: review sessions, credentials, and downstream access tied to VPN use.
• Preserve evidence before reboot or upgrade if compromise is suspected.
• Expand monitoring around edge appliances. Traditional EDR-heavy strategies often leave VPN concentrators under-instrumented.

Final Assessment

Ivanti Connect Secure remains a prime target because it sits exactly where attackers want to be: at the intersection of remote access, identity trust, and internal network reach. The disclosure of CVE-2026-111357 and CVE-2026-118527 is another reminder that edge-device exploitation is still one of the fastest paths from external exposure to enterprise compromise.

The right response is not just patching. It is patch, hunt, validate, and review identity impact. Organizations that do all four will dramatically reduce dwell time and improve their chances of catching post-exploitation before it becomes a broader intrusion.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub