NexusSec.VPN appliances sit on the internet by design, which makes them one of the first things attackers try. This post reflects what was published up to 1 November 2026.
What happened
In early October 2026, the security firm Volexity found a threat actor it tracks as UTA0576 breaking into Ivanti Connect Secure VPN appliances that were fully patched at the time. The attackers chained three flaws to run code as root without logging in:
- CVE-2026-104935, an authentication bypass. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October.
- CVE-2026-118527, which CISA lists as a predictable identifier flaw. It lets an attacker upload content to a location they can predict, which the chain uses to run code.
- CVE-2026-111357, a missing authentication check on a critical function, used to raise privileges to root.
CISA added the last two to the KEV catalogue on 30 October 2026, which means it has evidence they are being exploited. US federal agencies were given until 2 November and 13 November to fix them.
What the attackers went after
According to reporting on Volexity's findings, once the attackers controlled an appliance they went after Active Directory credentials and other sensitive data, including LAPS passwords and BitLocker recovery keys. A VPN appliance holds the keys to the network behind it, which is why flaws like these matter far beyond the appliance itself.
Which versions fix it
- Connect Secure 22.8R2.5 and earlier: upgrade to 22.8R2.6.
- Connect Secure 25.1.1.2 and earlier: upgrade to 25.1.1.3.
Reports say Ivanti has published no workaround for the two newest flaws, so the upgrade is the fix. Check Ivanti's own advisory for your exact version.
What to do
- Find every Ivanti Connect Secure appliance, including old ones nobody uses any more but that are still reachable from the internet.
- Upgrade to 22.8R2.6 or 25.1.1.3.
- Look for signs of compromise: unexpected administrator accounts, unusual VPN sessions, and connections from the appliance to internal servers. Volexity advises a forensic investigation of any appliance that shows such signs.
- If you find signs of compromise, treat credentials that passed through the appliance as exposed: reset affected Active Directory passwords, rotate service-account and LDAP bind passwords, and rotate LAPS passwords and BitLocker recovery keys.
- Keep the admin interface off the internet, reachable only from internal management networks.
The bigger pattern
October 2026 brought exploited flaws in several vendors' edge devices, including Cisco's firewalls and the k0t credential campaign against Fortinet and Palo Alto devices. If your VPN is still the main way into your network, see VPN or ZTNA and firewall edge attacks.
