Ivanti Connect Secure VPN flaws under attack: update now

Attackers are breaking into Ivanti Connect Secure VPN gateways, the product once sold as Pulse Secure. CISA says the flaws let an outsider run commands on the gateway without a password, and attackers use that to steal logins and copy data. If your staff connect to the office through Ivanti Connect Secure, ask your IT vendor to update it today.

What happened

On 13 October 2026 Ivanti disclosed a flaw in Connect Secure, CVE-2026-104935, that attackers were already using. The US cybersecurity agency CISA added it to its list of holes in active use the same day.

On 30 October 2026 CISA added two more Connect Secure flaws to that list, CVE-2026-111357 and CVE-2026-118527. CISA says attackers chain them with the first one. One of the new flaws lets an attacker who is already on the gateway raise their access to full control. The other lets them place files of their own on it.

Is my VPN affected?

CISA lists these Ivanti Connect Secure versions as affected:

Exact fixed version numbers are in Ivanti's own advisory (linked below). If you are not sure which version you run, your IT vendor can see it on the gateway's admin page. CISA also notes that version 22.8 stops getting support on 31 January 2027, so plan the move to 25.x now.

Ivanti Connect Secure runs as a hardware box or a virtual appliance that the company manages itself. Cloud and virtual setups need the same update.

What to do

1. Find out if your company uses Ivanti Connect Secure or the older Pulse Secure VPN. The company that set up your network can tell you.
2. Ask them to install Ivanti's latest fixed release today, following Ivanti's security advisory for CVE-2026-104935 and its 25.x upgrade guide.
3. Do not take a clean result from Ivanti's Integrity Checker Tool as proof you are safe. CISA warns it may miss these attacks because the attacker's commands run in memory. Checking for a break-in needs network and memory forensics.
4. If a break-in is suspected, CISA points to Ivanti's recovery steps: back up the gateway settings, factory reset it (or rebuild a virtual one), upgrade to the latest version, then restore the settings.
5. After a suspected break-in, also reset passwords for every account the gateway knew about: domain, admin and local accounts. Replace stored certificates, API keys and licence server logins too.
6. Tell staff to report any odd VPN prompts or login alerts this week.

Related: our notice on another office VPN problem, Cisco ASA and FTD firewall VPN flaw under attack.

How SyncTech can help

If you are not sure whether your company's remote access VPN is an Ivanti box, ask our support team and we will help you check. Keeping software patched is also what our website care plan does for your business website.

Source and credit

We are sharing this news from CISA. This summary is written by Synctech in our own words.

• CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure, CISA, 13 October 2026 (revised 30 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerabilities-ivanti-connect-secure
• Known Exploited Vulnerabilities Catalog, CVE-2026-111357 and CVE-2026-118527, CISA, 30 October 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Retrieved 31 October 2026. Ivanti, Ivanti Connect Secure and Pulse Secure are trademarks of their owners. Synctech is not connected with Ivanti or CISA. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.