2026-10-31
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527: two more flaws added to CISA KEV (what to do about the October attacks)
On October 30, 2026, CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357, a local privilege escalation to root (CVSS v3.1 7.0), and CVE-2026-118527, a predictable-identifier flaw that lets a remote authenticated attacker place files with attacker-controlled content at a known location. CISA says both can be chained with CVE-2026-104935, the authentication bypass added to KEV on October 13. The due date for US federal agencies is November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. CISA lists versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. A US research firm reports the chain was exploited from October 3. CISA warns Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because commands run in memory. Our conclusion: patch now, and treat any appliance that was reachable from the internet since early October as possibly compromised until a forensic check says otherwise. We could not read Ivanti's advisory, so confirm fixed versions there.