CISA adds two more exploited Ivanti Connect Secure flaws to KEV

CISA adds two more exploited Ivanti Connect Secure flaws to KEV

30 October 2026: CISA has added CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalogue, and says attackers are chaining them with CVE-2026-104935, the zero-day it listed on 13 October, to run commands remotely without logging in, steal credentials and take data. US federal agencies have until 2 November to deal with the first and until 13 November with the second.

Not yet independently verified. Ivanti's own advisory pages would not render for us, so the fixed builds come from the Canadian Centre for Cyber Security's "versions prior to" list and the affected ranges from CISA, and the two do not match exactly. We will add Ivanti's own fixed-version table once we can read it. We will update this when it can be confirmed, and remove this note.

Three flaws, one chain

The October zero-day was covered here when Ivanti disclosed it. The two additions are what turns it into a full takeover:

• CVE-2026-111357, missing authentication for a critical function: a locally authenticated attacker can escalate privileges. KEV due date 2 November, and CISA marks it for forensic triage.
• CVE-2026-118527, generation of predictable identifiers: a remotely authenticated attacker can upload files with attacker-controlled content to a known place on disk. KEV due date 13 November.

CISA says the three together allow remote, unauthenticated execution of arbitrary commands. Its ransomware column for both reads "Unknown". The Canadian Centre for Cyber Security says open-source reporting had shown CVE-2026-111357 being exploited before CISA listed it.

Which builds are affected

CISA's revised alert gives the affected ranges as 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier. The Cyber Centre's advisory, updated the same day, lists Connect Secure versions prior to 25.1.1.3, prior to 25.1.3.1 and prior to 22.8R2.6. The difference matters for anyone who moved to 25.1.3.0 after our 21 October item: on the Cyber Centre's list that build is still affected, so the target is now 25.1.3.1 on that line, 25.1.1.3 on the 25.1.1 line, or 22.8R2.6.

CISA also reminds owners that Connect Secure 22.8 reaches end of life on 31 January 2027, so 22.8R2.6 buys three months. Ivanti's 25.x upgrade and migration guide covers the move for hardware and virtual appliances.

Why the integrity checker is not enough

CISA warns that Ivanti's Integrity Checker Tool may not find signs of CVE-2026-104935 being used, because the attacker's commands run in memory. Proving an appliance is clean takes network and memory forensics. Where compromise is suspected, CISA's steps from Ivanti's recovery procedure are:

1. back up the appliance configuration;
2. factory reset and upgrade, or for cloud and virtual appliances rebuild the instance on the latest version;
3. restore the configuration;
4. reset every password the appliance held, revoke and reissue its certificates, and reset API keys and licence server credentials.

Step 4 is the expensive one, and the one most often skipped. Because the chain was used for credential theft, any account that authenticated through the VPN since early October should be treated as possibly exposed.

Connect Secure and the other VPNs we list

Our VPN software category lists 13 products, and we list Ivanti. The Cyber Centre advisory also covers Ivanti Neurons Patch for Intune before the 16 September 2026 release and Ivanti Xtraction before 2026.4.

Related on TrustList:

• Ivanti Connect Secure zero-day lets attackers run commands unauthenticated
• NetScaler CVE-2026-88771: public exploit turns targeted attacks into mass scanning, so patch and hunt now
• SonicWall patches CVSS 10 pre-login flaw in SMA1000 gateways

Sources

• CISA: CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (first issued 13 October, revised 30 October), 30 October 2026
• CISA Known Exploited Vulnerabilities catalogue (version 2026.10.30), 30 October 2026
• Canadian Centre for Cyber Security: Ivanti security advisory AV26-1035, update 2, 30 October 2026