Ivanti CVE-2026-111357 and CVE-2026-118527: What to Do

If you run Ivanti Connect Secure, the job this weekend is the same as two weeks ago, only with less room for doubt. On 30 October 2026 CISA added two more Connect Secure flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-111357, a privilege escalation to root, and CVE-2026-118527, a predictable-identifier bug that lets an authenticated attacker write files to a known location on disk. KEV says both chain with CVE-2026-104935, the authentication bypass Ivanti patched on 13 October.

Upgrade to a release that fixes CVE-2026-104935 if you have not already. Then treat any appliance that was exposed on 22.8R2.4 or earlier during October as a possible compromise. As of 31 October we could not find a public fixed version for either of the two new CVEs, and the sections below explain why.

The three CVEs in the chain

The KEV entries for CVE-2026-118527 and CVE-2026-111357 both say the flaw “can be chained with” the other two. Read together, the descriptions fit a familiar pattern: an unauthenticated foothold, a way to place attacker-controlled content where the appliance will find it, then a jump to root. That ordering is our reading of the descriptions. Neither Ivanti nor CISA has published the step-by-step mechanics.

The MITRE record for CVE-2026-111357 adds one technical detail. It says Connect Secure 22.8R2.4 “mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.”

If you track these programmatically, this pulls the three entries from CISA’s KEV JSON. We ran it with Python 3.13 on 31 October; it uses only the standard library:

import json, urllib.request

URL = "https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json"
WANT = {"CVE-2026-104935", "CVE-2026-118527", "CVE-2026-111357"}

with urllib.request.urlopen(URL, timeout=30) as r:
    kev = json.load(r)

for v in kev["vulnerabilities"]:
    if v["cveID"] in WANT:
        print(v["cveID"], v["dateAdded"], v["dueDate"],
              "triage=" + v.get("forensicTriage", "?"), ",".join(v["cwes"]))

Output on 31 October:

CVE-2026-118527 2026-10-30 2026-11-13 triage=No CWE-340
CVE-2026-111357 2026-10-30 2026-11-02 triage=Yes CWE-306,CWE-862,CWE-345
CVE-2026-104935 2026-10-13 2026-10-16 triage=Yes CWE-290

For what each field means and how to match the feed against a scanner export, see our guide to the CISA KEV JSON feed.

What is fixed and what is not

CVE-2026-104935 has fixes. The CVE record Ivanti published says the bug affects “ICS before version 25.1.3.0” and “does not impact ICS version 22.7R2.14 or prior”. It lists 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14 as unaffected.

Rapid7’s write-up of Ivanti’s advisory breaks this down by branch: 25.1.1.1 and earlier fixed in 25.1.1.2, 25.1.2.2 and earlier fixed in 25.1.3.0 and 25.1.3.1, and 22.8R2.4 and earlier fixed in 22.8R2.5. The 25.1.1.2 entry does not appear in the CVE record’s unaffected list, so confirm it against Ivanti’s advisory before you rely on it.

CVE-2026-111357 and CVE-2026-118527 have no fixed version that we could confirm. When Ivanti disclosed CVE-2026-104935 on 13 October, it fixed two stages of the chain. The Register and The Hacker News both reported that a third flaw, the privilege escalation, had no fix yet, and quoted Volexity saying Ivanti planned to fix it “in the coming weeks”.

Since then:

• The only CVE record for CVE-2026-111357 is MITRE’s. It lists 22.8R2.4 as affected and gives no fixed version. Its references are Volexity’s report and Ivanti’s CVE-2026-104935 advisory, not a separate Ivanti advisory.
• CVE-2026-118527 had no record in the CVE List repository when we checked on 31 October. Its KEV entry is the only primary description we found.
• Both KEV entries list Ivanti’s CVE-2026-104935 advisory as the vendor reference, and both carry CISA’s standard required action: apply vendor mitigations, or “discontinue use of the product if mitigations are unavailable”.
• Canada’s Cyber Centre updated its advisory on 16 October to say open-source reporting indicates CVE-2026-111357 is exploited. Singapore’s CSA alert, last updated 30 October, still names only CVE-2026-104935 and advises updating “to the latest versions”.

We could not read Ivanti’s advisory directly during this run, and Ivanti may have published a fix that these records do not yet reflect. Check the advisory and Ivanti’s support portal before you decide that your current version is enough.

Why 22.8R2.4 matters

According to The Hacker News’s summary of Volexity’s report, Volexity found the chain on a customer appliance running 22.8R2.4, which was fully patched at the time. That is the exact version MITRE’s CVE-2026-111357 record lists as affected. Exploitation began on 3 October, ten days before disclosure.

Volexity tracks the actor as UTA0576. The same reports say the attacker:

• stole LDAP domain credentials from the appliance, searched Active Directory for passwords and ran password-spraying attacks;
• used no malware or web shells, only commands already on the appliance (per The Register);
• was assessed by Volexity, with low confidence, as criminally rather than espionage motivated.

Two vendor statements limit how much you can learn from the appliance itself. Rapid7 quotes Ivanti saying “reliable indicators of compromise are not available”. The Hacker News reports Volexity saying the Ivanti Integrity Checker Tool does not detect this chain, even though Ivanti still recommends running it regularly.

Triage checklist

1. Inventory. List every Connect Secure appliance and its exact version, including standby units and lab boxes that face the internet.
2. Close the entry point. Upgrade anything below the fixed versions for CVE-2026-104935 (see above). This is the unauthenticated step. KEV describes the other two flaws as needing an authenticated or local attacker.
3. Assume compromise on exposed 22.8R2.4-and-earlier appliances. If an appliance ran a vulnerable version on the internet during October, patching does not undo what an attacker already did. Neither Ivanti nor Volexity has said that upgrading removes existing access.
4. Rotate what the appliance knows. Volexity saw LDAP credentials stolen. Rotate the directory bind account and any other service credentials stored on the appliance, and review VPN user sessions and tokens. This is our recommendation, based on the reported attacker behavior. Our explainer on why MFA does not always stop token theft covers the session side.
5. Hunt outside the appliance. With no reliable on-box IOCs, the useful signals are in your other logs:
   • password spraying or bursts of failed authentications from the appliance’s internal IP against Active Directory;
   • LDAP queries from the appliance that go beyond its normal user lookups;
   • in web or WAF logs in front of the appliance, large numbers of requests to /dana-na/auth/url_default/welcome.cgi, and requests whose X-DSCGI-PATH header does not match the URL path (both indicators Volexity published, as reported by The Hacker News);
   • traffic to or from 108.165.147[.]64, the IP Volexity listed.
6. Escalate to forensics if you find anything. Volexity says confirming compromise needs network and memory forensics. Our guide to CISA BOD 26-04 explains what the KEV “forensic triage” flag asks of federal agencies and what private teams can borrow from it.
7. Decide on exposure while you wait. Until a fix for CVE-2026-111357 is confirmed, limit who can reach the appliance where you can. KEV’s own fallback is to stop using the product if mitigations are unavailable. Our post on the FortiMail zero-day with no patch walks through the same decision for another edge device.

Limits of this article

• We did not test any of these flaws, and we have not seen exploit code.
• We could not fetch Ivanti’s advisory or Volexity’s report directly. Version and fix details come from the CVE records, CISA KEV data and Rapid7’s reproduction of the advisory. Attacker behavior and indicators come from press summaries of Volexity’s findings, which we attribute throughout.
• CVE-2026-118527 had no CVE record when we checked, so its description rests on one source, CISA’s KEV entry.
• Fix status can change quickly. Treat “no confirmed fix” as true for 31 October 2026 only.

Sources and verification

IvantiConnect SecureVpnKevVulnerability ManagementIncident Response