Ivanti Connect Secure: three bugs are enough, a patch for only the first is not

In October Ivanti Connect Secure grew a chain of three bugs. CVE-2026-104935 bypasses login. CISA added it on 13 October, and some builds already fixed it alone. CVE-2026-111357 raises privileges for someone already on the device. CVE-2026-118527 is about predictable identifiers. Alone, the second and third sound modest. Together with the first, CISA describes remote command execution without authentication, credential theft, and data theft. On 30 October those two entered the catalog as well.

Which version closes the chain

The full set is 25.1.1.3 or 22.8R2.6, released 29 October. Builds such as 25.1.1.2 and 22.8R2.5 closed the login bypass and left the rest. The 22.8 line ends on 31 January 2027, and Ivanti tells people to move to 25.x rather than live on the bridge until the last day. CISA gave US federal agencies until 2 November for CVE-2026-111357 and until 13 November for CVE-2026-118527. For a private company that is not a legal deadline. It is a measure of how short a window the people who are required to patch consider normal.

If the gateway was already on the internet

CISA says separately that the built-in integrity check can miss exploitation of CVE-2026-104935, because commands run in memory. A suspected compromise is not fixed by "we installed the patch and carried on." Take a configuration backup, factory-reset or rebuild the virtual machine, install the latest version, restore the config, and reissue passwords, certificates, and API keys. That is unpleasant for a week of remote work. It is more honest than a log an attacker with control of the device may already have cleaned.