Ivanti patched two more actively exploited Connect Secure flaws on 29 October. Organisations that applied only the mid-October update remain exposed.
Zero-day attacks against enterprise remote-access appliances continued through October. On 29 October 2026 Ivanti patched two more flaws in Connect Secure, and on 30 October the US cybersecurity agency CISA added both to its Known Exploited Vulnerabilities (KEV) catalog. The critical detail: organisations that applied the mid-October update are still exposed.
What happened
The attack does not rely on a single bug but on three that work together. The first link, CVE-2026-104935 (CVSS 8.6), bypasses authentication and lets unauthenticated requests reach protected handlers. The second, CVE-2026-118527 (CVSS 4.3), writes an uploaded file to a predictable path before it is validated. The third, CVE-2026-111357 (CVSS 8.8), abuses a missing authorisation check in a maintenance service running as root, which hands the attacker full control of the appliance.
The versions Ivanti shipped on 13 October, 25.1.1.2 and 22.8R2.5, only fixed the first flaw. The safe builds for the other two are 25.1.1.3 and 22.8R2.6. CISA set 2 November 2026 as the federal remediation deadline for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527.
Why it matters
Compromising the appliance was the starting point, not the goal. According to the incident reports, once attackers had root they harvested domain credentials, queried Active Directory for LAPS passwords and BitLocker recovery keys, captured LDAP traffic and ran password-spraying attempts. The VPN box was used as a door into the rest of the corporate network.
The second point is that the intrusion left very little behind. The reports state that the attackers deployed no web shell or persistent backdoor and cleaned up logs and payloads afterwards. Ivanti's own Integrity Checker Tool reported no changes on the affected appliance, and CISA warned that the tool may miss this activity. In this case, "we ran the checker and it came back clean" is not sufficient verification.
What this means for SMEs
Internet-facing VPN and firewall appliances carry branch connectivity, field teams and remote work for most small and mid-sized companies in Turkey. They are also the classic install-and-forget component: when patch tracking is not written into a service agreement, these devices can sit on an outdated build for months.
There is a compliance angle too. Article 12 of Turkey's Personal Data Protection Law (KVKK, Law No. 6698) requires data controllers to maintain an appropriate level of security, and an incident involving stolen credentials triggers the breach notification process. Leaving a publicly known, already-patched vulnerability open is a factor that weighs against the organisation in that process.
What Kamer Bilişim recommends
- Verify your build today; the October patch is not enough. Upgrade Connect Secure appliances to 25.1.1.3 or 22.8R2.6. Anything still on 25.1.1.2 or 22.8R2.5 does not count as patched.
- Rotate credentials after patching. Terminate active sessions and change administrator passwords, certificates and the service-account passwords the VPN authenticates against. Because the chain was built around credential theft, patching alone does not close the incident.
- Put patch tracking in the contract. For edge devices, a maintenance agreement that follows vendor advisories, issues a monthly version report and responds to emergency patches within 48 hours is what makes the difference in cases like this.
At your office on the Anatolian side of Istanbul or through remote support, we can review the version status of your VPN, firewall and server estate together and set up regular patch tracking under a corporate maintenance agreement. Get in touch through our contact page.
Source: Security Affairs, SOCRadar, CISA Known Exploited Vulnerabilities Catalog
Source: Security Affairs