CVE-2026-111357: Ivanti Connect Secure Exploit Chain Grants Unauthenticated Root — Detection and Remediation Guide

On Friday, CISA added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild exploitation. The headline flaw, CVE-2026-111357 (CVSS 8.8), is a missing authentication for a critical function vulnerability — and according to reporting, threat actors are chaining it with two additional ICS flaws to achieve unauthenticated root access on internet-facing VPN appliances.

If you've been in this industry for more than a few years, this should set off every alarm you have. Ivanti Connect Secure — the descendant of Pulse Secure — has been one of the most reliably targeted edge devices in the world. Edge VPN concentrators sit at the perfect intersection for attackers: internet-exposed, holding valid credentials and session tokens, rarely running EDR, and often excluded from routine vulnerability scanning because of appliance fragility concerns. When an adversary lands root on your VPN gateway, they own the front door to your network, your authentication flow, and a stealthy persistence point that most SOC tooling simply cannot see.

This is not a "patch when convenient" event. KEV listing means exploitation is confirmed, not theoretical. Federal civilian agencies are bound by Binding Operational Directive 22-01 remediation timelines, and every private-sector organization running ICS should treat this with the same urgency.

Technical Analysis

Affected Product

• Product: Ivanti Connect Secure (ICS) VPN gateway appliances (physical and virtual)
• Component: Web-facing administrative and portal interface services running on the appliance
• Exposure: Any ICS appliance reachable from the internet — which, by design, is most of them

The Vulnerabilities

The confirmed identifier from this disclosure:

• CVE-2026-111357 (CVSS 8.8) — Missing Authentication for a Critical Function (CWE-306). A critical function within the ICS web stack can be invoked without any authentication, giving a remote, unauthenticated attacker a foothold into privileged appliance functionality.

CISA added two ICS CVEs to the KEV in this action, and reporting indicates attackers are chaining three flaws total. The chain logic follows the classic ICS exploitation playbook we've seen repeatedly from both financially motivated actors and state-sponsored groups:

1. Unauthenticated entry (CVE-2026-111357): The missing-authentication flaw lets the attacker invoke a privileged function on the appliance's web interface with no credentials. This is the beachhead.
2. Privilege escalation / command execution: A second flaw in the chain converts that unauthenticated access into arbitrary command execution in an elevated context.
3. Root and persistence: A third flaw completes the chain to full root, after which actors typically deploy web shells, harvest credentials from the authentication subsystem, modify or disable logging, and establish persistence that survives reboots — and in past ICS campaigns, has even survived factory resets and integrity checks.

Why Chaining Matters for Defenders

Each individual flaw may look moderate in isolation. Chained, they produce the worst-case outcome: remote, unauthenticated, root-level code execution on a security appliance. This is why CVSS scores on individual CVEs routinely understate real-world risk on edge devices — your risk model must account for chainability, not just individual scores.

Exploitation Status

• Confirmed active exploitation in the wild
• CISA KEV listed (two CVEs added Friday)
• Historically, ICS zero-days have been exploited by state-nexus actors for espionage and by initial access brokers who sell footholds to ransomware affiliates. Assume both motivations are in play.

Treat every internet-facing ICS appliance as potentially compromised until you have patched and validated integrity.

Detection & Response

A hard truth first: ICS appliances don't run your EDR agent. Detection for this class of threat lives in three places — syslog forwarding from the appliance, network telemetry at the perimeter, and post-compromise behavior on internal systems the VPN gateway can reach. If your ICS appliances are not forwarding logs to your SIEM today, fixing that is part of this remediation.

Key observable behaviors from this attack chain:

• Unauthenticated HTTP requests hitting administrative or internal API paths on the appliance
• Web service processes spawning shells or interpreters (/bin/sh, perl, python) — legitimate ICS web components almost never do this
• Unexpected file writes under web-accessible directories (web shell deployment)
• New or modified local administrator accounts, unexpected configuration exports
• Log service tampering or gaps in the appliance's syslog stream
• Outbound connections from the appliance itself to unusual external hosts (C2) — the VPN gateway should initiate very little outbound traffic

Sigma Rules

---
title: Ivanti Connect Secure Web Process Spawning Shell or Interpreter
id: 3f8a2c41-7b9d-4e5a-9c12-8d6f4a1b7e55
status: experimental
description: Detects shell or interpreter execution spawned from ICS web service components, consistent with post-exploitation activity following CVE-2026-111357 chaining. Applies to Linux servers/forwarders ingesting ICS appliance logs.
references:
  - https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/home/bin/web'
      - '/home/bin/monitored'
      - 'dslogd'
      - 'httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/perl'
      - '/python'
      - '/python3'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate appliance maintenance scripts; validate against vendor documentation and change windows
level: critical
---
title: Unauthenticated Access to Ivanti ICS Administrative Endpoints
id: 6c1d9e72-4a8b-4f3c-b2d7-9e5f1a3c8d44
status: experimental
description: Detects HTTP requests to ICS administrative or internal API paths without a valid authenticated session, as seen in CVE-2026-111357 pre-auth exploitation. Intended for web/proxy logs or ICS syslog forwarded to SIEM.
references:
  - https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri|contains:
      - '/dana-admin/'
      - '/dana-na/'
      - '/admin/'
      - '/api/v1/'
      - '/rest/'
  selection_status:
    sc-status:
      - 200
      - 302
  filter_auth:
    cs-cookie|contains: 'DSID='
  condition: selection_paths and selection_status and not filter_auth
falsepositives:
  - Legitimate admin logins will carry a session cookie after authentication; unauthenticated 200s on admin paths are the anomaly of interest
  - Vulnerability scanners — whitelist known scanner IPs
level: high
---
title: Web Shell File Creation in Ivanti ICS Web-Accessible Directories
id: 9b4e7d15-2c6f-4a1e-8b3d-5f9c2e7a1d66
status: experimental
description: Detects creation or modification of executable script files in ICS web-accessible paths, a hallmark of web shell deployment after root-level compromise via exploit chaining.
references:
  - https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/10/19
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/home/webserver/htdocs/'
      - '/dana/'
  selection_ext:
    TargetFilename|endswith:
      - '.cgi'
      - '.pl'
      - '.py'
      - '.sh'
      - '.php'
  condition: selection_paths and selection_ext
falsepositives:
  - Vendor upgrades write to these paths — correlate with patching/upgrade maintenance windows and Ivanti Integrity Checker Tool output
level: critical

KQL — Microsoft Sentinel / Defender

The query below hunts ICS appliance syslog (forwarded via CEF/Syslog) and firewall logs for pre-auth requests to administrative paths, plus post-compromise indicators such as the appliance initiating unexpected outbound connections. Correlate TimeGenerated against your patch timeline — hits before patch completion warrant IR escalation, hits after are higher-confidence malicious.

// Hunt: Ivanti ICS pre-auth exploitation and post-compromise behavior
let AdminPaths = dynamic(["/dana-admin/", "/dana-na/", "/admin/", "/api/v1/", "/rest/"]);
let ICSHosts = (CommonSecurityLog
  | where DeviceVendor =~ "Ivanti" or DeviceProduct contains "Connect Secure"
  | summarize by DeviceName, SourceIP);
union isfuzzy=true
  // Stage 1: Unauthenticated requests to admin/internal paths on ICS
  (CommonSecurityLog
  | where DeviceVendor =~ "Ivanti" or DeviceProduct contains "Connect Secure"
  | where RequestURL has_any (AdminPaths)
  | where RequestMethod == "POST" or RequestURL has_any (".cgi", ".pl", "config", "upload")
  | extend Indicator = "PreAuth_AdminPath_Request"
  | project TimeGenerated, Indicator, SourceIP, SourceUserName, RequestURL, RequestMethod, DestinationHostName, DeviceAction),
  // Stage 2: Appliance syslog indicating shell execution, config export, or log tampering
  (Syslog
  | where Computer has_any ("ics", "pulse", "ivanti") or Facility == "local4"
  | where SyslogMessage has_any ("/bin/sh", "web shell", "config exported", "new admin", "log cleared", "dslogd stopped", "integrity check failed")
  | extend Indicator = "ICS_PostCompromise_Syslog"
  | project TimeGenerated, Indicator, Computer, HostIP, ProcessName, SyslogMessage),
  // Stage 3: ICS appliance initiating rare outbound connections (possible C2)
  (CommonSecurityLog
  | where SourceIP in (toscalar(ICSHosts | project SourceIP))
  | where DeviceVendor !~ "Ivanti"
  | where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
  | summarize ConnectionCount = count(), Destinations = make_set(DestinationIP, 20) by SourceIP, bin(TimeGenerated, 1h)
  | where ConnectionCount < 50  // VPN gateways chatter a lot inbound, very little outbound-initiated
  | extend Indicator = "ICS_Rare_Outbound"
  | project TimeGenerated, Indicator, SourceIP, Destinations, ConnectionCount)
| sort by TimeGenerated desc

Velociraptor VQL

If you have Velociraptor deployed on jump boxes or management hosts that administer ICS appliances — or on any Linux system the compromised gateway could reach — this artifact hunts for shells spawned by web services, recently modified files in web directories, and suspicious outbound connections. Deploy it fleet-wide on management-segment hosts while you run the Ivanti Integrity Checker Tool (ICT) on the appliances themselves.

-- Hunt: ICS exploit chain post-compromise artifacts on management/jump hosts
-- Looks for web-spawned shells, web directory writes, and odd outbound connections
LET proc_hits = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (CommandLine =~ '/bin/(sh|bash)|perl|python' 
   AND (Exe =~ 'httpd|web|nginx' OR CommandLine =~ 'curl|wget'))
   OR CommandLine =~ 'base64 -d|/tmp/|/dev/shm/'

LET web_writes = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/home/webserver/htdocs/**/*.cgi',
                 '/home/webserver/htdocs/**/*.pl',
                 '/home/webserver/htdocs/**/*.py',
                 '/home/webserver/htdocs/**/*.sh',
                 '/var/www/html/**/*.sh'])
WHERE Mtime > now() - 1209600  -- last 14 days

LET net_hits = SELECT Pid, Name, LocalAddress, RemoteAddress, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemoteAddress !~ '^10\\.|^192\\.168\\.|^172\\.(1[6-9]|2[0-9]|3[01])\\.|^127\\.'
  AND Name =~ 'sh|perl|python|curl|wget|nc'

SELECT 'suspicious_process' AS FindingType, format(format='%v', args=proc_hits) AS Details FROM scope()
WHERE count(items=proc_hits) > 0
UNION ALL
SELECT 'web_directory_write' AS FindingType, format(format='%v', args=web_writes) AS Details FROM scope()
WHERE count(items=web_writes) > 0
UNION ALL
SELECT 'shell_outbound_connection' AS FindingType, format(format='%v', args=net_hits) AS Details FROM scope()
WHERE count(items=net_hits) > 0

Verification & Hardening Script (Bash)

Run this on ICS appliances via SSH (admin console) or adapt for your jump host that audits the appliance. It collects the evidence you need to answer the only question that matters: was this box hit before we patched?

#!/bin/bash
# ICS post-exploitation triage helper — run on the appliance or against mounted logs
# Collects indicators tied to pre-auth exploitation chains and web shell deployment

echo "=== [1] ICS software version (must match Ivanti advisory fixed build) ==="
cat /home/etc/VERSION 2>/dev/null || swversion 2>/dev/null

echo "=== [2] Recently modified files in web-accessible directories (last 14 days) ==="
find /home/webserver/htdocs /dana -type f \( -name '*.cgi' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' \) -mtime -14 -ls 2>/dev/null

echo "=== [3] Shells/interpreters spawned by web processes in logs ==="
grep -Ei '(/bin/sh|/bin/bash|perl|python).*(httpd|web)' /var/log/messages* /home/logs/* 2>/dev/null | tail -50

echo "=== [4] Unauthenticated hits to admin paths (no DSID session cookie) ==="
grep -Ei '(dana-admin|dana-na|/admin/|/api/v1/)' /home/logs/access* 2>/dev/null | grep -v 'DSID=' | tail -50

echo "=== [5] New or modified local admin accounts ==="
grep -Ei '(admin.*(created|added|modified)|new administrator)' /home/logs/events* /var/log/messages* 2>/dev/null | tail -30

echo "=== [6] Log service tampering / gaps ==="
grep -Ei '(dslogd.*(stop|kill)|log.*(cleared|deleted|truncated))' /var/log/messages* /home/logs/events* 2>/dev/null | tail -30

echo "=== [7] Unexpected outbound connections from appliance ==="
netstat -antup 2>/dev/null | grep ESTABLISHED | grep -Ev '^(.*)(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' | head -30

echo "=== [8] Cron and persistence check ==="
cat /etc/crontab 2>/dev/null; ls -la /etc/cron.d/ 2>/dev/null
find /etc/cron* -type f -mtime -14 -ls 2>/dev/null

echo ""
echo "NEXT STEPS:"
echo " - Run the Ivanti Integrity Checker Tool (ICT) and compare against known-good baseline"
echo " - If ANY finding above is unexplained: isolate appliance, preserve logs, open IR case"
echo " - Do NOT assume patching removes an existing implant — validate integrity first"

Remediation

1. Patch immediately. Apply the fixed ICS builds per Ivanti's official security advisory (check the Ivanti Security Advisories portal at https://www.ivanti.com/blog and the advisory for CVE-2026-111357 for exact fixed version numbers for your branch). Do not delay for a change window — this is a KEV-listed, actively exploited, unauthenticated-to-root chain.
2. Respect CISA KEV deadlines. Federal civilian executive branch agencies must remediate per BOD 22-01 timelines from the KEV listing date. Private-sector organizations should adopt the same clock — historically KEV flaws are weaponized at scale within days.
3. Patch is not proof of clean. These appliances were exploitable before you patched. Run the Ivanti Integrity Checker Tool (ICT) on every appliance. If ICT flags anomalies — or your log review shows pre-patch admin-path hits — treat it as a confirmed breach: factory reset, re-image from known-good media, then patch, then reconfigure from scratch. Do not restore configs from a potentially compromised appliance.
4. Rotate everything the gateway touched. On any appliance with suspected or confirmed compromise: all local admin credentials, all user VPN credentials, certificates and private keys stored on the appliance, LDAP/RADIUS bind accounts, and any API tokens. Attackers with root on the auth gateway have had access to all of it.
5. If you cannot patch today, take the appliance offline or place it behind a restricting ACL limiting portal access to known IP ranges. There is no meaningful configuration workaround for a missing-authentication flaw — network-level restriction is the only interim mitigation.
6. Forward appliance logs to your SIEM now. ICS syslog to Sentinel/Splunk/QRadar is non-negotiable. Retain at least 90 days hot, 12 months cold. An appliance you can't see is an appliance you'll never know was breached.
7. Hunt downstream. A compromised VPN gateway is a launchpad. Review authentication logs for anomalous VPN sessions (impossible travel, unusual source ASNs, sessions outside user baselines) and hunt internal lateral movement originating from VPN-assigned address pools since the appliance's exposure window.
8. Plan for the architecture question. This is another entry in a long line of edge-VPN compromises. If your organization has been hit by repeated ICS emergency patch cycles, this is the moment to seriously evaluate zero-trust access replacements or, at minimum, moving the VPN concentrator behind a separate internet-facing inspection layer.

The Bottom Line

CVE-2026-111357 and its chained companions are exactly the class of threat that burns down networks: unauthenticated, root-level, on the device that guards your perimeter, exploited before most defenders read the advisory. The organizations that come out clean are the ones that patch in hours, verify integrity rather than assume it, rotate credentials aggressively, and have the log telemetry to answer "were we hit?" with evidence instead of hope.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub