Ivanti Connect Secure Zero-Day Chain CISA KEV Explained: Two More Exploited Flaws, 2 November Deadline
Illustrative image: server racks at NERSC — the kind of gateway infrastructure Ivanti Connect Secure runs on. This is not an Ivanti product photo; the flaws are software vulnerabilities, not a device. Image: Wikimedia Commons, CC0.
TL;DR — Ivanti Connect Secure zero-day chain CISA KEV explained: on 30 October 2026, CISA added two more exploited Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog — CVE-2026-111357 and CVE-2026-118527. They complete the zero-day chain attackers used against fully patched VPN gateways in early October. Patch to 22.8R2.6 or 25.1.1.3 now; the federal deadline for the privilege-escalation flaw is 2 November 2026.
📌 KEY HIGHLIGHTS
- The listing: CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on 30 October 2026, taking the catalog to 1,766 entries.
- The chain: the two flaws complete the attack chain Volexity caught in early October, when a group it calls UTA0576 broke into a fully patched Ivanti VPN gateway without a password and reached root.
- The deadlines: US federal civilian agencies must remediate CVE-2026-111357 by 2 November 2026 and CVE-2026-118527 by 13 November 2026.
- The fix: Ivanti shipped patches on 29 October — upgrade to 25.1.1.3 or 22.8R2.6. Patching in mid-October alone is not enough.
- The catch: the attack runs largely in memory and wipes its own tracks, so Ivanti's Integrity Checker may miss it — CISA requires forensic triage for CVE-2026-111357.
Ivanti Connect Secure zero-day chain CISA KEV explained: what was added?
On 30 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — the list reserved for flaws with confirmed evidence of exploitation in the wild. Both are pieces of a single attack chain, and both are chained with the Ivanti flaw that made headlines two weeks earlier, CVE-2026-104935.
The chain, documented by security firm Volexity, began on 3 October 2026, when an actor it tracks as UTA0576 exploited an Ivanti Connect Secure appliance running version 22.8R2.4 — the newest release at the time. The attackers needed no login: an authentication bypass opened the door, a file-upload trick ran their code, and a privilege-escalation flaw took them to root. From there they went straight after Active Directory secrets: LDAP service account credentials, LAPS local administrator passwords and BitLocker recovery keys, plus credentials captured from LDAP traffic.
Ivanti fixed the front door of the chain, CVE-2026-104935, on 13 October. The patches for the remaining two links only shipped on 29 October — and CISA's 30 October listing is the confirmation that those links were genuinely weaponised, not just theoretically exploitable. Ivanti says it is aware of exploitation in the wild affecting a limited number of customers when the three flaws are chained.
The three flaws in the chain
Illustrative image: code on a monitor — the exploit chain runs largely in memory, leaving little on disk for checkers to find. Image: Wikimedia Commons / Markus Spiske, CC0.
| Flaw | What it does | Status |
|---|---|---|
| CVE-2026-104935 (CVSS 8.6) | Authentication bypass by spoofing; unauthenticated remote command execution | Fixed 13 Oct 2026 (25.1.1.2, 25.1.3.0/25.1.3.1, 22.8R2.5); KEV-listed 13 Oct |
| CVE-2026-118527 (CVSS 4.3) | Predictable numbers/identifiers; an authenticated attacker uploads files with attacker-controlled content to a known location on disk | Fixed 29 Oct 2026; KEV-listed 30 Oct; federal deadline 13 Nov 2026 |
| CVE-2026-111357 | Missing authentication for a critical function; a local authenticated attacker escalates privileges to root | Fixed 29 Oct 2026; KEV-listed 30 Oct; federal deadline 2 Nov 2026; forensic triage required |
For the two new flaws, the affected versions are 25.1.1.2 and earlier, and 22.8R2.5 and earlier. The resolved versions are 25.1.1.3 and 22.8R2.6 (25.1.3.1 on the 25.1.3 branch). One important note for planners: the 22.8 branch reaches end of life on 31 January 2027, and Ivanti recommends moving to 25.x — so a move to 25.1.1.3 now also gets you off a dying branch. CISA lists ransomware use as unknown for both new entries; that means no ransomware link has been established, not that one has been ruled out.
Why patching in mid-October was not enough
This is the detail that makes the 30 October listing matter. Many administrators patched CVE-2026-104935 in mid-October and moved on — reasonably, since that was the only fix available. But the chain's root step had no patch until 29 October, and CISA's listing now confirms it was exploited. An appliance patched to 22.8R2.5 or 25.1.1.2 is still exposed to the two new flaws. Check your build number against the table above, not just against the October 13 advisory.
There is a second, harder problem. Volexity reports that UTA0576 installed no web shell and no backdoor: every command re-ran the exploit chain, the attacker edited debug and audit logs to remove its traces, deleted temporary files, and restored everything it changed in memory. Because no files on disk were modified, Ivanti's Integrity Checker Tool — built to find unexpected file changes — does not flag the compromise. CISA's alert carries the same warning, and its KEV entry for CVE-2026-111357 explicitly requires forensic triage. A clean checker result is not proof the box was never hit. If the appliance was internet-facing between early October and the 29 October patch, treat it as potentially compromised: investigate, and rotate the credentials it held — LDAP service accounts, LAPS passwords and BitLocker recovery keys are exactly what this actor collected.
Why it matters for World Tech readers
VPN gateways are the front door of a corporate network: they sit on the internet by design, and whoever controls one inherits the remote-access path into everything behind it. That is why edge appliances — Ivanti, Citrix, Fortinet, Cisco — keep appearing in CISA's exploited list, and why this week's KEV stories keep following the same pattern: the patch exists, and the risk sits with estates that have not applied it yet. Readers in India should take the same message: Indian enterprises, outsourced IT providers and managed service providers run exactly this kind of gateway for clients worldwide, and the 2 November federal deadline is a sensible internal target even though BOD 26-04 binds only US federal agencies. Read it alongside our Warp Panda VMware ESX flaw CISA KEV explainer, our Fragnesia Linux kernel flaw CISA KEV explainer and our PHP2Shell CISA KEV explainer for the week's other exploited flaws.
Should you care?
✅ Verdict: Yes, if your organisation runs Ivanti Connect Secure — upgrade to 25.1.1.3 or 22.8R2.6 now, then hunt for compromise on any appliance exposed since early October. Patching alone does not evict an attacker or recover stolen credentials. Everyone else can note the lesson: a "patched" gateway is only patched against the flaws fixed so far, and in a chained attack the last patch is the one that matters.
FAQs
What is the Ivanti Connect Secure zero-day chain?
A three-flaw chain found by Volexity in October 2026: CVE-2026-104935 bypasses authentication and runs commands without a login, CVE-2026-118527 places attacker-controlled files at known disk locations, and CVE-2026-111357 escalates privileges to root. Together they give unauthenticated root access to a VPN gateway, and the actor behind them, UTA0576, used the access to steal Active Directory credentials.
What did CISA add to its KEV catalog on 30 October 2026?
CISA added CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (predictable numbers or identifiers), both in Ivanti Connect Secure, based on evidence of active exploitation. The catalog version is 2026.10.30, with 1,766 entries in total.
Which Ivanti Connect Secure versions fix the flaws?
For CVE-2026-111357 and CVE-2026-118527, upgrade to 25.1.1.3 or 22.8R2.6 (25.1.3.1 on the 25.1.3 branch). Affected versions are 25.1.1.2 and earlier and 22.8R2.5 and earlier. The earlier flaw, CVE-2026-104935, was fixed in 25.1.1.2, 25.1.3.0/25.1.3.1 and 22.8R2.5 — so the October 29 patch is an additional step, not a repeat.
Does patching remove an attacker who is already inside?
No. The chain installs no persistent malware, so patching closes the door but does not remove access already gained or recover credentials already stolen. CISA requires forensic triage for CVE-2026-111357, and its alert warns the Integrity Checker Tool may miss this attack because it runs in memory. Investigate exposed appliances and rotate LDAP, LAPS and BitLocker credentials they held.
Takeaway: CISA's 30 October listing closes the book on October's Ivanti zero-day chain — but only for gateways that actually take the 29 October patch. If you stopped at the mid-October fix, you are one patch behind an exploited chain, and the 2 November deadline is days away.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (30 Oct 2026)
- CISA — Known Exploited Vulnerabilities Catalog, version 2026.10.30 (KEV entries for CVE-2026-111357 and CVE-2026-118527)
- Volexity — A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (13 Oct 2026, updated for the 29 Oct patch)
- The Stack — Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation (29 Oct 2026)
Comments
Post a Comment