Security Guides

#vulnerability #CVE-2026-111357 #CVE-2026-118527 #CVE-2026-104935 #Ivanti #Connect Secure #VPN #exposed services

Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: two more flaws added to CISA KEV (what to do about the October attacks)

CISA added two more Ivanti Connect Secure flaws to KEV on October 30: CVE-2026-111357 (privilege escalation to root) and CVE-2026-118527 (file upload). Both chain with CVE-2026-104935. Affected versions, why the Integrity Checker may miss it, and what to do.

Published 2026-10-31 Updated 2026-10-31 Last verified 2026-10-31 8 min read

On this page

Audience: administrators of Ivanti Connect Secure (VPN appliances). This page is based on CISA's KEV catalog and alert, NVD and a research firm's blog; it contains no attack steps or exploit code. We could not read Ivanti's own advisory (the page did not load), so fixed version numbers are not given here.

Developing: this page will be updated as more is published

As of October 31, 2026 (JST)

Not yet known

Fixed versions for each of the three flaws (we could not read Ivanti's advisory)
Whether a fix exists for CVE-2026-118527
NVD's record for CVE-2026-118527 (not found in NVD as of our check)
How many organizations were affected and who is behind the attacks

CISA added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog on October 30 and updated its alert the same day. CVE-2026-104935 was added on October 13. We checked CISA's KEV feed, CISA's alert, NVD and the research firm's blog on October 31.

What to do today

List your Connect Secure appliances and versions

Include virtual and cloud appliances. CISA lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. Version 22.8 reaches end of life on January 31, 2027, according to CISA, so plan the move to 25.x as well.

Update to the latest version

CISA tells organizations to update to the latest version as set out in Ivanti's advisory and its 25.x upgrade and migration compatibility guide. We could not read the advisory, so confirm the fixed version for your train there before you start.

Check for compromise, not only for a patch

The research firm and CISA both say the Integrity Checker Tool may miss exploitation of CVE-2026-104935. CISA says determining compromise requires network and memory forensics. If the appliance was reachable from the internet since early October, ask your incident response provider to do this before or alongside the update (our judgment). Also review lateral movement attempts that originated from the appliance, as the research firm suggests.

If compromise is suspected, rebuild and reset credentials

CISA's guidance from the October 13 alert covers this: back up the configuration, reset to factory state and upgrade (rebuild virtual and cloud appliances), restore the configuration, then replace credentials. That means passwords for domain, admin and local accounts, certificates stored on the appliance, API keys, and license server credentials.

Cut off what you can reach until you are sure

Restrict the appliance's management interface to an administration network, and review what the appliance can reach inside your network. Decide in advance how remote staff will connect if you must take it offline.

Three flaws that chain

Ivanti Connect Secure CVE-2026-104935, CVE-2026-111357, CVE-2026-118527

CVE-2026-104935: Authentication bypass by spoofing; a remote unauthenticated attacker can execute arbitrary commands (CISA KEV, added October 13). Covered in our October roundup
CVE-2026-111357: Missing authentication for a critical function (CISA); NVD describes a flaw leading to privilege escalation to root. CVSS v3.1 7.0 (local, high complexity, low privileges). Added to KEV October 30; due date November 2; forensic triage: Yes
CVE-2026-118527: Generation of predictable identifiers (CWE-340); a remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. Added to KEV October 30; due date November 13; forensic triage: No
Chain: CISA says CVE-2026-111357 and CVE-2026-118527 can each be chained with CVE-2026-104935 (and with each other). CISA says exploitation allows remote, unauthenticated execution of arbitrary commands, used for credential theft and data exfiltration
Affected: 25.1.1.2 and prior, 25.1.2.2 and prior, 22.8R2.5 and prior (CISA alert, updated October 30)
Fixes: CVE-2026-104935: patches released October 13 (research firm). CVE-2026-111357: the research firm says a patch was published October 29. CVE-2026-118527: not found. Confirm in Ivanti's advisory

Why the CVSS score is only 7.0: on its own, CVE-2026-111357 needs local access and a low-privilege account. The score does not reflect the chain. Per the research firm's report, combining an authentication bypass, a file-handling flaw and this privilege escalation gave unauthenticated root-level control of an appliance that was fully patched at the time (22.8R2.4). Judge your risk by the chain, not by the single score (our judgment).

The version lists do not agree exactly. The NVD description of CVE-2026-111357 names 22.8R2.4, while NVD's affected list includes 22.8R2 to 22.8R2.5 and 25.1 releases before 25.1.1.3. CISA's list is broader (25.1.2.2 and prior). Use the widest list until Ivanti's advisory settles it.

1. Authentication bypass

CVE-2026-104935 (KEV Oct 13)

2. File upload

CVE-2026-118527 (KEV Oct 30)

3. Privilege escalation to root

CVE-2026-111357 (KEV Oct 30)

The three flaws can be chained, per CISA, NVD and a research firm's report (our summary).

Timeline

October 3
A US research firm says it saw exploitation begin (its blog, published October 13).
October 13
According to the research firm, Ivanti publishes patches for the authentication bypass; CISA adds CVE-2026-104935 to KEV; the research firm publishes its findings.
October 29
The research firm updates its blog to say Ivanti has published a patch for the privilege escalation.
October 30
CISA adds CVE-2026-111357 (due November 2) and CVE-2026-118527 (due November 13) to KEV and updates its alert and the affected versions.

What is known and not known

Item	Status
Exploitation	CISA lists all three in KEV; attackers are said to steal credentials and data
Start of exploitation	October 3, per one research firm; not confirmed by Ivanti in what we could read
Fixed versions	Not confirmed by us; Ivanti's advisory did not load
CVE-2026-118527 fix	Not found
NVD for CVE-2026-111357	Analyzed; CVSS 7.0 supplied by CVE.org's record; CISA coordinator marks exploitation "active" and technical impact "total"
NVD for CVE-2026-118527	Record not found as of our check
Who is attacking, and how many victims	Not disclosed

Sources

Checked on October 31, 2026 (JST).

CISA, Known Exploited Vulnerabilities Catalog (CVE-2026-111357 and CVE-2026-118527 added October 30, 2026) — cisa.gov
CISA, "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure" (updated October 30, 2026) — cisa.gov
NVD, CVE-2026-111357 — nvd.nist.gov
Ivanti, "Security Advisory Ivanti Connect Secure (CVE-2026-104935)" — hub.ivanti.com (did not load when we checked; fixed versions must be confirmed here)
Security research firm's blog, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" (October 13, 2026, updated October 29) — blog

Update history

2026-10-31: First version, based on CISA's KEV catalog and alert, NVD and a research firm's blog.

Latest breaking reports

All breaking reports →

FAQ

QWhat happened?

On October 30, 2026, CISA added Ivanti Connect Secure CVE-2026-111357 (privilege escalation to root) and CVE-2026-118527 (file upload to a known location) to its KEV catalog. CISA says both can be chained with CVE-2026-104935, the authentication bypass added to KEV on October 13. CISA says attackers are exploiting these flaws to steal credentials and data.

QWhich versions are affected?

CISA's alert, updated October 30, lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. The NVD description of CVE-2026-111357 names 22.8R2.4, but NVD's affected list also includes 22.8R2.5 and 25.1 releases before 25.1.1.3. Check your exact train in Ivanti's advisory, which we could not read.

QIs there a fix?

According to a US research firm, Ivanti released patches for CVE-2026-104935 on October 13. A US research firm says Ivanti published a patch for the privilege escalation (CVE-2026-111357) on October 29, but we could not confirm this in Ivanti's advisory, and we found nothing on a fix for CVE-2026-118527. Confirm fixed versions in Ivanti's advisory and follow CISA's instruction to update to the latest version.

QWhy is a clean Integrity Checker result not enough?

CISA says Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because the attacker's commands run in memory. To tell whether an appliance was compromised, CISA says you need network and memory forensics. The research firm gives the same warning.

QDo I need to follow the November 2 and November 13 dates?

They are the due dates for US federal agencies, so Japanese and other organizations are not bound by them. They are still a useful guide. CISA's KEV entry marks forensic triage as required for CVE-2026-111357 and the shorter November 2 date shows how urgent CISA considers it (our judgment).

QWhere was this attack first reported, and who is behind it?

A US research firm published its findings on October 13, saying it saw exploitation from October 3. CISA does not say who is exploiting the flaws (nor did Ivanti in what we could read), and we do not name any group.