Ivanti Connect Secure: Two More Exploited Flaws, CVE-2026-111357 and CVE-2026-118527, Join CISA's KEV List

TL;DR: Ivanti Connect Secure, a VPN appliance many companies use for remote access, has an exploit chain under active attack. On October 29, 2026, Ivanti released fixes for the last two pieces, CVE-2026-111357 and CVE-2026-118527, and on October 30 CISA added both to its list of exploited flaws. Update to 25.1.1.3 or 22.8R2.6 (fixed versions as reported by The Stack and the Canadian Centre for Cyber Security). If the appliance ran an affected version in October, check it for compromise too, because Ivanti’s own checker may miss this attack.

What happened

On October 13, 2026, Ivanti disclosed CVE-2026-104935, an authentication bypass in Connect Secure that lets an attacker with no account run commands. It was already being exploited, and CISA listed it as exploited the same day. Security firm Volexity, which found the attacks, said the attackers chained it with a file-write bug and a privilege escalation to get root on a fully patched appliance. It also said Ivanti was still working on a fix for the privilege escalation.

On October 29, Ivanti released fixes for those two flaws, The Stack reported:

• CVE-2026-111357 (CVSS 8.8 per The Stack; NVD 7.0): a privilege escalation bug. NVD’s description says the appliance’s dsinvoked broker trusts DSCache configuration data in a way that leads to root.
• CVE-2026-118527 (CVSS 4.3 per The Stack): a bug that lets an authenticated attacker upload files with attacker-controlled content to disk.

Per Ivanti’s table as reproduced by The Stack, the fixed versions are 25.1.1.3 and 22.8R2.6. The Canadian Centre for Cyber Security (AV26-1035, updated Oct 30) lists Connect Secure versions before 25.1.1.3, before 25.1.3.1 and before 22.8R2.6 as affected. Neither source names a 25.1.2.x fix for these two flaws. The Stack quotes Ivanti explaining the gap between the two disclosures: “At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers.”

On October 30, CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog and revised its alert. CISA lists versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected; it lists affected versions only and gives no fixed versions. It says attackers used the flaws for credential theft and data exfiltration. CISA gave US federal agencies until November 2 to fix CVE-2026-111357, a deadline that has now passed, and until November 13 to fix CVE-2026-118527.

Volexity says a group it tracks as UTA0576 exploited the chain from October 3. The attackers stole credentials stored on the appliance, such as the domain account it uses for LDAP. They then went after Active Directory secrets, including LAPS local administrator passwords and BitLocker recovery keys, and deleted evidence from the appliance’s logs.

Why it matters

Our read: a VPN appliance holds the keys to the rest of the network, so a break-in here rarely stays on the box. The attackers aimed straight at domain credentials and recovery keys. The main danger for a small company is assuming the October 13 update ended the story. It closed the entry point, but the rest of the chain only got fixed on October 29. And appliances that ran a vulnerable version in early October may already have been compromised, which an update doesn’t undo. Our Security hub tracks other VPN and firewall flaws under attack, including this week’s Cisco ASA and FTD flaw.

What to do now

Our advice: work through these steps in order.

1. Find every Connect Secure appliance you or your IT provider run, including virtual and cloud ones, and note each version.
2. Update. Per Ivanti’s table as reproduced by The Stack, 25.1.1.x goes to 25.1.1.3 and 22.8 goes to 22.8R2.6. On 25.1.2.x, neither The Stack nor the Canadian Centre names a fix for the two new flaws, so ask Ivanti or your provider which build to install. CISA also points to Ivanti’s 25.x Upgrade and Migration Compatibility Guide for hardware and virtual appliances.
3. Don’t stop at the patch. If an appliance ran an affected version in October, look for signs of compromise. Ivanti’s Integrity Checker Tool may not catch this attack, because the commands run in memory.
4. If you suspect a compromise, follow CISA’s recovery steps. Back up the configuration, factory reset or rebuild, upgrade, and restore. Then reset every password the appliance touched, reissue its certificates and rotate its API keys.
5. Plan the move off 22.8 before it reaches end of life on January 31, 2027, per CISA.

Our tip: check your Active Directory logs for the LDAP account the VPN uses. If it signed in from anywhere other than the appliance, or ran unusual directory searches in October, treat it as compromised and reset it.

Sources & method

Source	What it confirms	Link
The Stack (Oct 29, 2026)	Ivanti’s affected and fixed versions table (25.1.1.3, 22.8R2.6; 25.1.1.2, 25.1.3.0/25.1.3.1, 22.8R2.5 for CVE-2026-104935), CVSS 8.8 and 4.3, the Ivanti quote on the disclosure gap, Volexity’s list of attacker actions	The Stack
Canadian Centre for Cyber Security AV26-1035 (updated Oct 30, 2026)	Connect Secure affected before 25.1.1.3, 25.1.3.1 and 22.8R2.6; CVE-2026-111357 exploited per open-source reporting	Cyber Centre
NVD record for CVE-2026-111357	NVD score 7.0 and the dsinvoked/DSCache description	NVD
CISA KEV alert (Oct 30, 2026)	CVE-2026-111357 and CVE-2026-118527 added to the KEV catalog	CISA
CISA Ivanti alert (revised Oct 30, 2026)	Affected versions only (25.1.1.2, 25.1.2.2 and 22.8R2.5 and earlier; no fixed versions), credential theft and data exfiltration, the Integrity Checker caveat, recovery steps, 22.8 end of life	CISA
CISA KEV catalog (version 2026.10.30)	Dates added and federal due dates (Nov 2 for CVE-2026-111357, Nov 13 for CVE-2026-118527)	CISA
Volexity (Oct 13, 2026)	The UTA0576 attacks from Oct 3, what the attackers did after breaking in, indicators	Volexity

Last checked: Nov 3, 2026, 11:54 a.m. Manila (UTC+8). Method: Ivanti’s advisory page wouldn’t load for us, so Ivanti’s fixed versions, scores and statements are as reported by The Stack and the Canadian Centre for Cyber Security. We read CISA’s two alerts and its KEV catalog entries, Volexity’s report and NVD’s record for CVE-2026-111357. Steps marked “Our tip” or “Our advice” and analysis marked “Our read” are ours, not Ivanti’s, CISA’s or Volexity’s. The thumbnail is an original OneSignalDesk card summarizing the fixed versions as reported by The Stack and CISA’s alert. No affiliate links. How we work.

Updates

• Nov 3, 2026, 11:54 a.m. Manila: We now credit the fixed versions, scores and Ivanti’s statements to The Stack and the Canadian Centre for Cyber Security, because Ivanti’s advisory page wouldn’t load for us. We removed claims only Ivanti’s page supported, including its exploitation quote and its upgrade-path and hardware notes. Neither source names a 25.1.2.x fix for the two new flaws. CISA’s Nov 2 federal deadline for CVE-2026-111357 has passed. We found no newer fixed versions in either source.
• Oct 31, 2026, 7:44 a.m. Manila: First published. We’ll add a dated note if Ivanti changes the fixed versions or the exploitation status.