# Ivanti Connect Secure CVE-2026-111357 in KEV: What to Do

> CISA added two more Ivanti Connect Secure flaws to KEV on 30 Oct 2026, completing a zero-day chain that gives root. Versions, deadlines and checks.

Source: https://playciso.com/blog/ivanti-connect-secure-cve-2026-111357-kev · Published: 2026-10-30 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure

---

If you run **Ivanti Connect Secure**, assume your October patch is not enough. On 30 October 2026 CISA added **CVE-2026-111357** and **CVE-2026-118527** to its Known Exploited Vulnerabilities (KEV) catalog. They chain with **CVE-2026-104935**, the authentication bypass disclosed on 13 October, to give an unauthenticated attacker root on the appliance. CISA's revised alert lists **25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior** as affected. Upgrade to the build Ivanti published on 29 October, then hunt for compromise with network and memory forensics, because Ivanti's Integrity Checker Tool may not see it. **Who this is for:** teams that run Ivanti Connect Secure (formerly Pulse Connect Secure) for remote access, the security leaders who own the patch decision, and US federal agencies working to CISA deadlines. _Independent analysis based on CISA's KEV catalog and alerts, Volexity's research, and reporting by BleepingComputer and ITdaily. PlayCISO is not affiliated with Ivanti, Volexity or CISA. Facts are as reported on 30 October 2026 and may change._ The story in plain words **What:** three chained flaws in Ivanti Connect Secure. CVE-2026-104935 lets an unauthenticated attacker run commands; CVE-2026-111357 escalates to root; CVE-2026-118527 lets an authenticated attacker write files to a known place on disk. **Confirmed by:** CISA (all three in KEV, so CISA has evidence of exploitation), Volexity (found the chain in a customer incident) and Ivanti (aware of "limited exploitation in the wild", per BleepingComputer). **When:** exploited since at least 3 October 2026 (Volexity). Defused saw first signs on 1 October (BleepingComputer). **Fix:** the authentication bypass was patched in early October; the privilege escalation on 29 October. **Unknown:** how many organisations were breached. Ivanti has said only that a limited number of customers were affected. ## What happened Volexity was investigating suspicious activity at a customer from 5 October and published its findings on 13 October as "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days". It says an actor it tracks as **UTA0576** chained three vulnerabilities to get "unauthenticated root-level code execution" on an appliance that was fully patched at the time. According to Volexity: - The way in (CVE-2026-104935): an authentication bypass using the X-DSCGI-PATH header to reach protected CGI files, plus a race condition in wu.cgi where an uploaded file runs before the handler deletes it. - Root (CVE-2026-111357): a privilege escalation in how the dsinvoked broker trusts DSCache configuration data. Ivanti had not fixed it when Volexity first published; Volexity updated its post on 29 October to say Ivanti had released a patch. - No malware left behind. BleepingComputer quotes Volexity: "UTA0576 deployed no malware or web shell." The actor re-exploited the device for every command and tampered with logs. CISA describes the third flaw, **CVE-2026-118527**, as a "generation of predictable numbers or identifiers" weakness that "allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk", and says it can be chained with the other two. ### What the attacker did once inside This is why the patch alone does not close the incident. Volexity lists: extracting stored LDAP domain credentials; searching Active Directory for LAPS passwords, BitLocker recovery keys and attributes holding passwords; Kerberoasting; password spraying; capturing LDAP traffic with a renamed `tcpdump` and parsing it for credentials; collecting configuration files and authentication logs; staging results in `/tmp/`; and deleting or tampering with debug and audit logs. A VPN appliance holds the keys to your directory. Once those are taken, the attacker no longer needs the VPN. Volexity also assesses, with medium confidence, that UTA0576 used large language models to develop the exploit and for post-exploitation work, and with low confidence that the actor is criminally motivated rather than state-backed. ## Timeline When (2026)WhatSource 1 OctFirst signs of exploitation seen by DefusedBleepingComputer 3 OctUTA0576 begins repeatedly exploiting the chain against a customer applianceVolexity 5 OctVolexity starts investigating; Ivanti releases 25.1.1.2Volexity; ITdaily 12 OctIvanti releases 22.8R2.5ITdaily 13 OctIvanti advisory for CVE-2026-104935; Volexity publishes; CISA adds CVE-2026-104935 to KEV (federal due date 16 Oct) and issues an alertCISA; Volexity; BleepingComputer 29 OctIvanti publishes the fix for privilege escalation CVE-2026-111357Volexity (update) 30 OctCISA adds CVE-2026-111357 (due 2 Nov, forensic triage required) and CVE-2026-118527 (due 13 Nov) to KEV and revises its alertCISA ## Am I affected? You are in scope if you run Ivanti Connect Secure on any of the versions CISA lists: **25.1.1.2 and prior, 25.1.2.2 and prior, or 22.8R2.5 and prior**. Note what that means: the builds that fixed the first bug (25.1.1.2 on 5 October and 22.8R2.5 on 12 October, per ITdaily) are on the list, because they do not fix CVE-2026-111357. Reports of Ivanti's 29 October update name **25.1.1.3** and **22.8R2.6** as fixed builds. Check the exact build for your platform in Ivanti's advisory before you schedule the upgrade. Exposure is wide. BleepingComputer reports that Shadowserver tracks more than 5,500 internet-exposed Connect Secure instances. CISA also notes that version 22.8 reaches end of life on 31 January 2027, so the 22.8 fix buys time, not a long-term home. ## What security leaders should do this week - Inventory every Connect Secure appliance, physical, virtual and cloud, with its exact build. Anything on CISA's list is exposed. - Upgrade to the 29 October build named in Ivanti's advisory. Use Ivanti's 25.x upgrade and migration compatibility guide, which CISA points to, for hardware and virtual appliances. - Do not rely on the Integrity Checker Tool. CISA: organisations "will need to conduct network and memory forensics to identify evidence of exploitation." Get memory captured before you reboot or reset an appliance you suspect. - Hunt in your logs. Volexity suggests looking for high volumes of requests to /dana-na/auth/url_default/welcome.cgi, especially where the X-DSCGI-PATH header does not match the URL path, and for post-exploitation files in /tmp/. Check its indicators of compromise. - If you find signs of compromise, follow CISA's recovery order: back up the configuration, factory reset and upgrade (rebuild cloud and virtual instances), restore the configuration, then reset passwords for all domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials. - Look behind the appliance. The attacker went after Active Directory. Review service accounts the VPN binds with, Kerberos ticket requests for service accounts (Kerberoasting), LAPS and BitLocker key reads, and password-spray patterns from the appliance's address. - Brief the board in one line: "Our remote-access gateway had a fully patched zero-day; here is whether we were exposed, what we checked, and when the credential reset finishes." ## The bigger lesson: the VPN is a credential vault BleepingComputer counts 36 Ivanti vulnerabilities in CISA's KEV catalog since November 2021, 12 of them abused by ransomware gangs. The same pattern plays out across edge appliances from several vendors; we wrote about it for [Citrix NetScaler](/blog/why-citrix-netscaler-keeps-getting-breached). Three habits make the next one cheaper: - Patch KEV-listed edge flaws in days, not the monthly cycle. A KEV-first prioritisation rule removes the debate. - Plan for "patched but already owned". Every edge-appliance runbook should include the credential reset, not just the upgrade. - Limit what the appliance knows. A VPN bound to the directory with a highly privileged service account turns one appliance bug into a domain compromise. Scope that account to the minimum. ## Put it to work - Edge VPN Intrusion Lab: rehearse an edge VPN compromise from webshell to domain controller and make the containment decisions. - Identity Compromise Response Checklist: scope, revoke and rotate after directory credentials are exposed. - Kerberos Attack Lab: see how Kerberoasting works and what it looks like in your logs. - Vulnerability Prioritizer: rank your backlog with KEV status first. ## FAQ ### What is CVE-2026-111357? A missing-authentication-for-critical-function flaw in Ivanti Connect Secure that "could allow a local authenticated attacker to escalate their privileges" (CISA). Volexity describes it as the step to root. CISA added it to KEV on 30 October 2026 with a federal due date of 2 November. Ivanti published a fix on 29 October, according to Volexity. ### Which Ivanti Connect Secure versions are affected? CISA lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. That includes the early-October builds that fixed CVE-2026-104935. Reports name 25.1.1.3 and 22.8R2.6 as fixed; confirm in Ivanti's advisory. ### Is patching Ivanti Connect Secure enough? No, if the appliance was exposed before you patched. Volexity says the attacker took LDAP credentials and searched Active Directory for LAPS passwords and BitLocker keys. Follow CISA's recovery steps and reset credentials. ### Does the Ivanti Integrity Checker Tool detect this attack? Not reliably. CISA says it may miss the activity because commands run in memory, and that network and memory forensics are needed. Volexity says "the tool does not detect any modifications." ### Who is exploiting the Ivanti Connect Secure zero-days? An actor Volexity tracks as UTA0576, assessed with low confidence to be criminally motivated. No named group has been publicly attributed. ### What is the CISA deadline for the Ivanti Connect Secure flaws? 2 November 2026 for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527, for US federal civilian agencies. CVE-2026-104935 was due on 16 October. ## Sources - CISA: CISA urges patching newly exploited vulnerabilities in Ivanti Connect Secure (13 Oct 2026, revised 30 Oct) - CISA: CISA adds two Known Exploited Vulnerabilities to catalog (30 Oct 2026) and the KEV catalog - Ivanti: Security advisory, Ivanti Connect Secure (CVE-2026-104935) - Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (13 Oct 2026, updated 29 Oct) - BleepingComputer: Ivanti warns of Connect Secure zero-day exploited in attacks - ITdaily: Ivanti patches flaw in Connect Secure that attackers are already exploiting (14 Oct 2026) _This article is educational guidance for security leaders, not a forensic report. Always check Ivanti's advisory and CISA's alert for the latest versions and indicators before acting._