Exploited VPN flaws: 5 KEV entries for Ivanti, Cisco and SonicWall since 13 October

Summary. Between 13 October and 6 November 2026, CISA added five exploited flaws in three vendors' remote-access VPN products to its Known Exploited Vulnerabilities (KEV) catalogue: three in Ivanti Connect Secure, one in Cisco Secure Firewall ASA and FTD, and one in SonicWall SonicOS. The Ivanti trio matters most. Chained, CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 gave an attacker unauthenticated root access to an appliance on 22.8R2.4, then the latest release; the fixed releases are 25.1.1.3, 22.8R2.6 and 25.1.3.x. Cisco's CVE-2026-76418 (CVSS 8.6) lets an unauthenticated attacker reload an ASA or FTD that runs SSL remote-access VPN with secondary authentication. SonicWall's CVE-2026-19868 lets a user with valid credentials for another login method bypass SAML, and SAML-enforced MFA, on SSLVPN; Gen7 7.3.4-7013 and Gen8 8.2.3-8015 fix it. Three KEV due dates have passed. CVE-2026-118527 is due on 13 November and the SonicWall flaw on 20 November. Patching is not the end of the job: the Ivanti attacker stole directory credentials, edited logs and evaded Ivanti's Integrity Checker Tool, so a patched Ivanti appliance still needs a compromise review and a rotation of every secret it held.

About this article. For teams that run VPN and firewall appliances. On 11 November 2026 we checked every CVE, score, KEV date, fixed version and mitigation against NVD, the CISA KEV feed, CISA's Ivanti alert, the Cisco and SonicWall advisories and Volexity's research. Ivanti's advisory page did not load for us, so Ivanti details come from its NVD records, CISA's summary and labelled press reports. Vendors revise advisories often, so re-check before you act. This is not legal advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

For the Microsoft and browser side of the same fortnight, see our November 2026 Patch Tuesday patch order, which covers the Outlook and Chrome flaws CISA listed on 10 November with a 24 November due date.

Five KEV entries in 24 days

The table below comes from the KEV feed and the NVD records for each CVE.

Three due dates fell three days after listing and two allow 14 days. CISA's Binding Operational Directive 26-04 of 10 June 2026, which replaced BOD 22-01, sets these deadlines from internet exposure, KEV status, whether exploitation can be automated and whether the attacker gains partial or total control. For an exposed system on the KEV list, total control means three days plus a forensic triage; partial control means three days if exploitation is automatable and 14 if not. CISA rates CVE-2026-104935 and CVE-2026-111357 as total control, and the KEV feed requires forensic triage for exactly those two. CISA expects agencies to look for compromise on Ivanti appliances, not only to patch them.

For a private company these are US federal deadlines, not legal obligations, but they are a fair measure of urgency. Our Langflow KEV article explains why customers and insurers ask about KEV patch times.

Two scores differ by source. Ivanti rates CVE-2026-111357 at 8.8, as reported by SecurityWeek, while the NVD record, filed by MITRE, scores it 7.0 as a local attack. SonicWall scores CVE-2026-19868 at 7.1 with low privileges required; CISA's score is 7.5 with none. Neither changes the action.

The same weeks also brought KEV entries for a Palo Alto Networks PAN-OS flaw (14 October) and a Fortinet flaw affecting FortiOS (16 October); they are outside this article's scope.

Ivanti Connect Secure: a three-CVE chain to root

Ivanti published its advisory for CVE-2026-104935 on 13 October and added the other two CVEs, with fixes, on 29 October. SecurityWeek reports that Ivanti said the chained attacks had hit a limited number of customers by the time of disclosure.

Volexity found the activity. It began investigating a customer incident on 5 October 2026, traced it to an appliance on 22.8R2.4 (Build 19097), then the latest release, and found repeated exploitation from 3 October by an actor it tracks as UTA0576. The chain combined an authentication bypass in how welcome.cgi routes requests to other CGI scripts, a file-write flaw in wu.cgi, and a privilege escalation in the dsinvoked maintenance service. Ivanti tracks the bypass and code execution under CVE-2026-104935; the privilege escalation is CVE-2026-111357. CVE-2026-118527 covers predictable filenames that let an authenticated user write files to a known location, and CISA notes it can be chained with the other two.

What the attacker did next is why patching alone is not enough. Volexity reports that UTA0576:

• extracted credentials stored on the appliance, such as the domain account used for LDAP;

• used that service account to search Active Directory for LAPS local administrator passwords, BitLocker recovery information and password-bearing attributes;

• dumped and exfiltrated limited Active Directory metadata;

• ran password spraying and a custom Kerberos tool for credential testing;

• parsed packet captures on the appliance to harvest LDAP credentials;

• removed its own entries from the appliance debug log and the Linux audit log;

• deployed no backdoor or web shell, re-running the exploit chain for each command instead.

The privilege-escalation step patched library code in memory only and restored the configuration it changed, so Ivanti's Integrity Checker Tool did not detect any modification. CISA repeats the warning and says that finding compromise needs network and memory forensics. A clean integrity scan does not clear an appliance that was exposed in October.

Which Ivanti version to run

The table uses the version ranges in the NVD records and CISA's alert.

SecurityWeek reports Ivanti as saying it fixed part of the flaw in 25.1.3.0 in July and was still bringing that fix to other releases when the attacks happened. Before choosing a release, read Ivanti's Connect Secure 25.x Upgrade and Migration Compatibility Guide, which CISA points to for hardware and virtual appliance specifics.

Ivanti compromise checks

Volexity's recommendations give a defensible sequence.

1. Look for the request pattern. Volexity advises watching for many requests to /dana-na/auth/url_default/welcome.cgi that carry an X-DSCGI-PATH header, and for any mismatch between the URL path and that header. Search proxy, load-balancer and WAF logs from late September: Volexity saw the attacker's server running from 30 September, and SecurityWeek reports that the firm Defused logged attacks on its decoys from 1 October.

1. Use the published indicators. Volexity's GitHub folder for this case holds an indicator list and YARA rules.

1. Check the temporary directory. Volexity recommends looking in /tmp/ on the appliance for traces of attacker tools and output, though the attacker deleted some.

1. Watch the appliance's footprint inside your network. Unusual LDAP queries for LAPS or BitLocker attributes by its service account, Kerberos request bursts and spikes of failed logons from its internal address are the signals Volexity's findings point to.

1. Escalate to forensics if anything fits. Volexity and CISA both say memory and network forensics are needed to confirm exploitation.

If you suspect compromise, CISA recommends Ivanti's recovery procedure: back up the configuration, factory-reset and upgrade the appliance (or rebuild a virtual instance), restore the configuration, reset passwords for all accounts including domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and licence server credentials.

Treat the appliance's Active Directory service account as exposed. Rotate it, review which accounts can read LAPS passwords and BitLocker recovery information, and rotate LAPS passwords in the scope that account could read. Our guide to non-human identity governance covers keeping service accounts like this one scoped and audited.

Cisco ASA and FTD: CVE-2026-76418

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (bug CSCwx26625) on 28 October 2026 and says its PSIRT became aware of active exploitation in October. The flaw is in the Remote Access SSL VPN service of Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. Logic errors when secondary authentication is set on a tunnel group let an unauthenticated, remote attacker make the device reload with a crafted request while connecting. The CVSS score is 8.6, the impact is availability only, and no successful VPN login is needed.

A device is vulnerable only when all three conditions hold:

• it runs a vulnerable ASA or FTD release;

• the SSL remote-access VPN login service is enabled and reachable (webvpn with enable interface_name on at least one interface);

• secondary authentication (secondary-authentication-server-group) is set on a tunnel group in scope. If tunnel-group-list enable is configured, check every tunnel group, including DefaultWEBVPNGroup; if not, check DefaultWEBVPNGroup alone.

For FTD, check the deployed remote-access VPN policy and running configuration in FMC or FDM. Cloud-delivered Firewall, cloud-delivered FMC, Secure Access and Secure FMC Software are not affected. Cisco's first fixed releases are below.

Two data conflicts are worth knowing. NVD treats FTD up to and including 7.6.7 as vulnerable, while Cisco names 7.6.7 as the first fix; Cisco says its PSIRT validates only the releases in its own advisory, so follow Cisco and run the Cisco Software Checker against your exact release. NVD also groups ASA 9.19 with 9.20 (fixed by 9.20.4.50), and Cisco's table has no 9.19 row, so move a 9.19 device to a listed train.

Cisco lists no workaround, but documents a mitigation: remove secondary authentication from exposed tunnel groups. If DefaultWEBVPNGroup does not use secondary authentication, no tunnel-group-list enable in WebVPN configuration mode removes the list users choose from. If it does, no secondary-authentication-server-group removes secondary authentication, which Cisco says lowers the security posture of remote access. Upgrade instead wherever you can.

Compromise checks here are about availability. Review uptime and crash records since October, correlate unexpected reloads with VPN connection attempts in syslog, and check both units of a failover pair.

SonicWall SonicOS: CVE-2026-19868

SonicWall's advisory SNWLID-2026-0014, published on 6 November 2026 and updated on 9 November, covers seven SonicOS CVEs, one of them exploited. CVE-2026-19868 lets a user with valid credentials for an alternate authentication method bypass SAML controls on SSLVPN, and with them any MFA that SAML enforces. SonicWall says it applies only when SAML is enabled for SSLVPN logins, and that its PSIRT investigated a report indicating potential exploitation. CISA listed it in KEV on 6 November, due 20 November. The 9 November update revised the workaround, so re-read it if you saw the first version.

The workaround points at LDAP, RADIUS and TACACS+ as the alternate methods. In practice the flaw undoes the main reason to put VPN logins behind SAML: someone holding a directory password from phishing or a breach dump may not need the second factor. The affected and fixed builds are:

NVD's configuration data does not match the advisory on either line: it uses 7.3.4-7015 as the Gen7 boundary and treats 8.2.2-8015, the last affected Gen8 build, as fixed. Follow SonicWall's fixed versions.

If you use SAML for SSLVPN and cannot upgrade at once, SonicWall's workaround is to disable or delete every active LDAP, RADIUS and TACACS+ authentication server configured on the firewall, under Device, Users, Settings, Authentication. Check first whether anything else on the firewall, such as administrator logins or user identification, depends on those servers.

The advisory also fixes six flaws not reported as exploited: two 8.8-rated management-interface flaws (CVE-2026-107154 and CVE-2026-107155), a pre-authentication heap overflow in SSL-VPN that can cause a denial of service (CVE-2026-82308, rated 7.5), two pre-authentication overflows in the TACACS+ client (CVE-2026-77708 and CVE-2026-77709) and a weak password hashing issue on virtual appliances (CVE-2026-19703). The fixed firmware covers all of them, another reason to upgrade rather than rely on the workaround.

For compromise checks, export SSLVPN login events since at least October and look for sessions without a SAML assertion, SAML-only accounts logging in another way, and logins from unusual countries or networks. A VPN login with no matching sign-in at your identity provider deserves a closer look. Reset passwords for any account that logged in that way, and review what those sessions reached.

What to patch first across the five

If you own more than one of these platforms, this is the order we would work in on 11 November.

Ivanti comes first because it is the only one of the five with published evidence of activity inside a victim network, and 25.1.2.x is still open to the chain's unauthenticated first step. SonicWall comes before Cisco because it can hand an attacker a working VPN session, while the Cisco flaw takes the VPN offline.

Compromise checks for any VPN appliance

The five flaws differ, but the response after an exploited edge-device bug is the same, and most teams skip it.

• Get logs off the box. Forward VPN, system and admin-audit logs to a store the appliance cannot write to. Organisations covered by CERT-In's directions must keep ICT logs for a rolling 180 days within India.

• Diff the configuration. Compare it with your last known-good backup: new local admins, changed authentication servers, new tunnel groups or portals, altered certificate bindings.

• Rotate what the appliance holds. Directory bind accounts, RADIUS and TACACS+ shared secrets, local admin passwords, API keys and, where root compromise is possible, the TLS and signing certificates.

• Watch the appliance's internal footprint. Its own address talking to domain controllers, file servers or management interfaces in new ways is often the earliest sign.

• Record the evidence. Versions before and after, upgrade time, checks run and results. Customers and auditors ask for it.

If you find signs of compromise, reporting duties apply. In India, CERT-In direction No. 20(3)/2022-CERT-In of 28 April 2022 requires service providers, intermediaries, data centres, body corporates and government organisations to report listed incidents, including compromise of critical systems and unauthorised access to IT systems, within 6 hours of noticing them. Organisations in the EU and UK should check their own notification rules.

Why edge devices keep landing in KEV

VPN concentrators and firewalls sit on the internet by design, run complex pre-authentication code and hold the credentials that bridge the internet and the directory. They also run closed operating systems where most endpoint detection tools cannot, which is why the Ivanti attacker could rely on in-memory changes and log edits.

There are two practical responses. In the short term, shrink exposure: keep management interfaces off the internet, restrict VPN portals to the countries and networks you need, and patch edge devices within days rather than on a monthly cycle. In the longer term, many organisations are replacing broad network-level VPN access with identity-aware, per-application access (zero-trust network access), so a compromised gateway exposes less. Our network solutions team plans that kind of move, and the 31 January 2027 end of life for Ivanti 22.8 is a natural point to decide.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can patch Ivanti, Cisco and SonicWall remote-access appliances, run the log reviews and credential rotation described here, and assess whether an exposed appliance was compromised. Talk to us at /contact-us/.

Last updated: 11 November 2026.

References

1. Known Exploited Vulnerabilities Catalog, JSON feed version 2026.11.10 — CISA

1. A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, 13 October 2026 — Volexity

1. CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure, last revised 30 October 2026 — CISA

1. Cisco Secure Firewall ASA and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability, 28 October 2026 — Cisco

1. SNWLID-2026-0014, SonicWall SonicOS Affected By Multiple Vulnerabilities, updated 9 November 2026 — SonicWall PSIRT

1. CVE-2026-104935 record (NVD API) — NIST NVD

1. CVE-2026-111357 record (NVD API) — NIST NVD

1. CVE-2026-118527 record (NVD API) — NIST NVD

1. CVE-2026-76418 record (NVD API) — NIST NVD

1. CVE-2026-19868 record (NVD API) — NIST NVD

1. BOD 26-04: Prioritizing Security Updates Based on Risk, 10 June 2026 — CISA

1. Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain, 2 November 2026 — SecurityWeek

1. threat-intel repository, 2026-10-13 Ivanti indicators — Volexity on GitHub

1. Directions under sub-section (6) of section 70B of the IT Act, No. 20(3)/2022-CERT-In, 28 April 2022 — CERT-In