If your Ivanti Connect Secure gateway is exposed to the internet, treat this as an incident-response problem, not just a patching ticket. Attackers reportedly began exploiting the flaws in October, and CISA warns that installing updates may not remove an intruder who already got inside.
Researchers describe a chain of three zero-days that could let attackers reach root-level access without authentication, steal credentials, and take data. CISA lists affected versions including 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier. Check the CISA alert and Ivanti’s advisory for the exact fixes that apply to your appliance.
“October 1” is a warning, not a clean start date
Threat intelligence reporting points to signs of exploitation as early as October 1. Volexity separately says it observed an attack chain on a customer appliance beginning October 3, and opened its investigation on October 5. Those are different observations, so don’t treat October 1 as a confirmed first-intrusion date.
The reported chain involves CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. The first was patched on October 13, with fixes for the other two issued October 29, according to the reporting and updated disclosures. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog in October.
One detail deserves extra attention: investigators reported log tampering and code running in memory. That can make a routine check look reassuring when it shouldn’t. Volexity and CISA caution that Ivanti’s Integrity Checker Tool may not find every sign of compromise.
Patch the gateway. Then decide whether to rebuild it.
Apply the appropriate Ivanti update promptly. But if the appliance was exposed during the exploitation window, or you find suspicious activity, don’t assume the update has evicted an attacker. CISA recommends network and memory forensics, followed by Ivanti’s recovery procedure when compromise is suspected.
That recovery can mean backing up the configuration, factory-resetting and upgrading the appliance (or rebuilding a cloud or virtual instance), then restoring the configuration. You’ll also need to reset domain, administrator, and local passwords, and revoke and reissue stored certificates and credentials, including API keys and license-server credentials.
Volexity also published case-specific hunting leads, including unusual requests to /dana-na/auth/url_default/welcome.cgi with a mismatched X-DSCGI-PATH header. Its report mentions /data/.icscap/ and the IP 108.165.147[.]64. These are clues from one investigation, not a complete list of indicators. Compare them with the current guidance from Volexity and CISA before drawing conclusions.
If you’re responsible for one of these gateways, get your security and network teams to confirm the appliance version, exposure window, and recovery plan today. If you can’t rule out compromise, bring in incident-response help before putting the appliance back into trusted service.
Book an urgent 15-minute incident-response consultation
We’ll help you map the next steps, with no obligation.